You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "Ksenia Hershkovici (Jira)" <ji...@apache.org> on 2022/02/16 09:04:00 UTC

[jira] [Created] (MNG-7414) Maven version 3.8.3 + 3.8.4 have jsoup vulnerability

Ksenia Hershkovici created MNG-7414:
---------------------------------------

             Summary: Maven version 3.8.3 + 3.8.4 have jsoup vulnerability
                 Key: MNG-7414
                 URL: https://issues.apache.org/jira/browse/MNG-7414
             Project: Maven
          Issue Type: Bug
            Reporter: Ksenia Hershkovici


Hi Team,

We are facing jsoup component vulnerability with maven versions 3.8.3 and 3.8.4 which is the latest released version of maven. The CVE details are: CVE-2021-37714

Jsoup version which is getting installed while installing maven 3.8.3 and 3.8.4 is v1.12.1.

We noticed that both versions have wagon 3.4.3 that is probably installing Jsoup v1.12.1.

Can you please provide the details of next maven version release with this fix in it?

Thanks.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)