You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "Michael Osipov (Jira)" <ji...@apache.org> on 2020/03/01 13:02:00 UTC
[jira] [Updated] (MNG-6872) Found CVEs in your dependencies
[ https://issues.apache.org/jira/browse/MNG-6872?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Osipov updated MNG-6872:
--------------------------------
Fix Version/s: waiting-for-feedback
> Found CVEs in your dependencies
> -------------------------------
>
> Key: MNG-6872
> URL: https://issues.apache.org/jira/browse/MNG-6872
> Project: Maven
> Issue Type: Dependency upgrade
> Reporter: XuCongying
> Priority: Major
> Fix For: waiting-for-feedback
>
>
> I noticed some of your libraries contained CVEs. I suggest a library update to avoid potential risks. See below for more details:
>
> Vulnerable Library Version: org.codehaus.plexus : plexus-utils : 1.5.5
> CVE ID: [CVE-2017-1000487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000487)
> Import Path: maven-core/src/test/resources-project-builder/micromailer/pom.xml
> Suggested Safe Versions: 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.24, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0
--
This message was sent by Atlassian Jira
(v8.3.4#803005)