Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Vulnerability: Latest 1.0.39 release depends on version of Scala with known vulernability #174

Open
big-andy-coates opened this issue Jan 26, 2023 · 1 comment

Comments

@big-andy-coates
Copy link
Contributor

big-andy-coates commented Jan 26, 2023

v1.0.39 of this library depends on org.scala-lang:scala-library:2.13.1, which has a known security vulnerability

Updating to the latest 2.13.10 release will fix this issue.

@big-andy-coates
Copy link
Contributor Author

Workaround is to force the use of a version of scala-library above 2.13.8. e.g. for Gradle users:

    configurations.all {
        resolutionStrategy.eachDependency {
            // Can be removed once https://github.com/mbknor/mbknor-jackson-jsonSchema/issues/174 resolved:
            if (requested.group == "org.scala-lang" && requested.name == "scala-library") {
                useVersion("2.13.10")
                because("security vulnerabilities found < 2.13.9: " +
                        "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36944")
            }
        }
    }

big-andy-coates added a commit to big-andy-coates/mbknor-jackson-jsonSchema that referenced this issue Jan 26, 2023
Fixes security vulnerability: mbknor#174
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant