[jira] [Commented] (WHISKER-20) Integrate update of Jdom in order to fix CVE

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WHISKER-20?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17466225#comment-17466225 ] 

ASF subversion and git services commented on WHISKER-20:
--------------------------------------------------------

Commit 3db02a769cc773f9e07c2a2b610312d92b59b8f7 in creadur-whisker's branch refs/heads/dependabot/maven/org.jdom-jdom-2.0.2 from Philipp Ottlinger
[ https://gitbox.apache.org/repos/asf?p=creadur-whisker.git;h=3db02a7 ]

WHISKER-20: Fix deprecation warning about GnuParser wich is default now


> Integrate update of Jdom in order to fix CVE
> --------------------------------------------
>
>                 Key: WHISKER-20
>                 URL: https://issues.apache.org/jira/browse/WHISKER-20
>             Project: Apache Whisker
>          Issue Type: Improvement
>            Reporter: Philipp Ottlinger
>            Assignee: Philipp Ottlinger
>            Priority: Major
>
> A simple upgrade of the jdom dependency does not work:
> https://github.com/apache/creadur-whisker/pull/6
> As Jdom is marked as a security problem of Whisker try updating and upgrading:
> {{
> CVE-2021-33813
> high severity
> Vulnerable versions: <= 2.0.6
> Patched version: No fix
> An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. At this time there is not released fixed version of JDOM. As a workaround, to avoid external entities being expanded, one can call builder.setExpandEntities(false) and they won't be expanded.
> }}
> currently available version is:
> <version>2.0.6.1</version>
> https://github.com/hunterhacker/jdom



--
This message was sent by Atlassian Jira
(v8.20.1#820001)