You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@mina.apache.org by "Emmanuel Lécharny (Jira)" <ji...@apache.org> on 2024/05/27 11:37:00 UTC
[jira] [Resolved] (DIRMINA-1178) Is there any plan to fix the dependent vulnerabilities of the dependent software pmd 4.3?
[ https://issues.apache.org/jira/browse/DIRMINA-1178?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lécharny resolved DIRMINA-1178.
----------------------------------------
Fix Version/s: 2.2.4
Resolution: Fixed
Fixed in trunk.
The next version is going to use PMD 7.0.0 and pmd-plugin 3.22.
Note that PMD is only used when compiling the project, so any CVE impacting PMD will not impact the produced jars.
> Is there any plan to fix the dependent vulnerabilities of the dependent software pmd 4.3?
> -----------------------------------------------------------------------------------------
>
> Key: DIRMINA-1178
> URL: https://issues.apache.org/jira/browse/DIRMINA-1178
> Project: MINA
> Issue Type: Wish
> Affects Versions: 2.2.3
> Reporter: Yuanhua Han
> Priority: Major
> Labels: security
> Fix For: 2.2.4
>
>
> Hello, we found that Apache MINA 2.2.3 depends on pmd 4.3, which is a very old version (released on November 11, 2011).
> And the dependent components of pmd 4.3 have some vulnerabilities. Currently, the pmd community has fixed these vulnerabilities in the latest version.
> Does this vulnerability affect Apache MINA? If yes, can I ask if there are any plans of Apache MINA community to adapt to the new version of pmd to fix these vulnerabilities? If so, which version of pmd will be adapted in the future?
> Thanks.
> The detailed dependencies and related vulnerabilities are as follows:
> mina-legal 2.2.3 ---> pmd 4.3 ---> ant 1.6(CVE-2012-2098)
> mina-legal 2.2.3 ---> pmd 4.3 ---> junit 4.4(CVE-2020-15250)
> mina-legal 2.2.3 ---> pmd 4.3 ---> jaxen 1.1.1 ---> dom4j 1.6.1(CVE-2018-1000632, CVE-2020-10683)
> mina-legal 2.2.3 ---> pmd 4.3 ---> jaxen 1.1.1 ---> xercesImpl 2.6.2(CVE-2018-2799, CVE-2022-23437)
> mina-legal 2.2.3 ---> pmd 4.3 ---> jaxen 1.1.1 ---> xom 1.0 ---> xercesImpl 2.6.2(CVE-2018-2799, CVE-2022-23437)
> mina-legal 2.2.3 ---> pmd 4.3 ---> jaxen 1.1.1 ---> xom 1.0 ---> xalan 2.6.0(CVE-2014-0107, CVE-2022-34169)
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org