Details
-
Type:
Task
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: 4.3
-
Component/s: None
-
Labels:None
Description
Software Composition Analysis reports finds that some of the dependencies used by the analyzer are vulnerable. Even we we don't use the features which are vulnerable, we should update those dependencies.
The potential vulnerabilities are:
- Remote code execution in commons-collections 3.2.1 (CVE-2015-6420 and CVE-2017-15708)
- File path traversal in commons-io 2.6 (https://issues.apache.org/jira/browse/IO-559)
