Tags
People
Badges
Help
[ERROR] Failed to execute goal org.sonatype.ossindex.maven:ossindex-maven-plugin:3.1.0:audit-aggregate (default-cli) on project nexus-proxy: Detected 2 vulnerable components:
[ERROR] com.google.protobuf:protobuf-java:jar:3.0.2:compile; https://ossindex.sonatype.org/component/pkg:maven/com.google.protobuf/[email protected]
[ERROR] * [CVE-2015-5237] Improper Restriction of Operations within the Bounds of a Memory Buffer (8.8); https://ossindex.sonatype.org/vuln/d47d20ab-eb2a-4cfd-8064-bbf6283649cb
[ERROR] com.google.guava:guava:jar:20.0:compile; https://ossindex.sonatype.org/component/pkg:maven/com.google.guava/[email protected]
[ERROR] * [CVE-2018-10237] Deserialization of Untrusted Data (5.9); https://ossindex.sonatype.org/vuln/24585a7f-eb6b-4d8d-a2a9-a6f16cc7c1d0
thanks for the information. It is possible to exclude these optional dependencies ZK will continue to function without them (during development it won't be able to generate source maps, which is what the google closure compiler is used for)
I posted the issue: ZK-4561 (it also mentions which dependency has to be excluded to avoid these alerts)
UPDATE (2020-05-25)
testable in the latest FL version for 9.1.0
e.g. 9.1.0.FL.20200522-Eval - pom : google closure compiler was updated and made optional so it doesn't appear in your transitive dependencies by default
yes that's the other option... keep in mind that, this won't prevent future problems e.g. if new vulnerabilities are found you have to update again... if you exclude the dependencies you they can't have future problems ;) that's why I suggested excluding them. anyways maven supports both ways.
cor3000 ( 2020-04-27 18:11:53 +0800 )editdon't worry, if it breaks it's a bug (please let us know if that's the case) see new features doc
cor3000 ( 2020-04-28 12:21:26 +0800 )editAsked: 2020-04-27 10:42:44 +0800
Seen: 12 times
Last updated: May 25 '20
