You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@gora.apache.org by "Kevin Ratnasekera (Jira)" <ji...@apache.org> on 2020/03/04 05:30:00 UTC

[jira] [Resolved] (GORA-642) Use HTTPS to resolve dependencies in Maven Build

     [ https://issues.apache.org/jira/browse/GORA-642?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Kevin Ratnasekera resolved GORA-642.
------------------------------------
    Resolution: Fixed

> Use HTTPS to resolve dependencies in Maven Build
> ------------------------------------------------
>
>                 Key: GORA-642
>                 URL: https://issues.apache.org/jira/browse/GORA-642
>             Project: Apache Gora
>          Issue Type: Improvement
>          Components: build process
>    Affects Versions: 0.9
>            Reporter: Kevin Ratnasekera
>            Assignee: Kevin Ratnasekera
>            Priority: Major
>             Fix For: 1.0
>
>
> This is a security fix for a vulnerability in Apache Maven pom.xml file(s).
> The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. This leaves build vulnerable to allowing a Man in the Middle (MITM) attackers to execute arbitrary code on local computer or CI/CD system.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)