You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "Hudson (Jira)" <ji...@apache.org> on 2020/04/04 22:25:00 UTC
[jira] [Commented] (MNG-6872) Found CVEs in your dependencies -
plexus-utils (tests)
[ https://issues.apache.org/jira/browse/MNG-6872?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17075321#comment-17075321 ]
Hudson commented on MNG-6872:
-----------------------------
Build failed in Jenkins: Maven TLP » maven » MNG-6825 #20
See https://builds.apache.org/job/maven-box/job/maven/job/MNG-6825/20/
> Found CVEs in your dependencies - plexus-utils (tests)
> ------------------------------------------------------
>
> Key: MNG-6872
> URL: https://issues.apache.org/jira/browse/MNG-6872
> Project: Maven
> Issue Type: Dependency upgrade
> Affects Versions: 3.6.3
> Reporter: XuCongying
> Assignee: Karl Heinz Marbaise
> Priority: Minor
> Fix For: 3.7.0
>
>
> I noticed some of your libraries contained CVEs. I suggest a library update to avoid potential risks. See below for more details:
>
> Vulnerable Library Version: org.codehaus.plexus : plexus-utils : 1.5.5
> CVE ID: [CVE-2017-1000487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000487)
> Import Path: maven-core/src/test/resources-project-builder/micromailer/pom.xml
> Suggested Safe Versions: 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.24, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0
--
This message was sent by Atlassian Jira
(v8.3.4#803005)