Vulnerabilities on Transitive Dependencies in Commons Compress 1.25

Question

Vulnerabilities on Transitive Dependencies in Commons Compress 1.25

ra-lukas opened this issue 9 months ago · 4 comments

Checkmarx in IntelliJ is warning on the use of org.apache.commons:commons-compress:1.25.0

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.25.0
CVE-2024-26308 7.5 Allocation of Resources Without Limits or Throttling vulnerability with High severity found
CVE-2024-25710 5.5 Loop with Unreachable Exit Condition ("Infinite Loop") vulnerability with Medium severity found

Looks like this was addressed in 1.26.

Just a heads up.

Answer 1 · 2024-03-22T12:01:28.000Z

Thank you for contributing to Poiji! Feel free to create a PR If you want to contribute directly :)

Answer 2 · 2024-03-22T12:07:16.000Z

Looks like the problem is with POI, which isn't scheduled to be updated for a while.... feel free to delete this issue if desired.

Answer 3 · 2024-03-22T14:53:37.000Z

Thanks @ra-lukas !

Answer 4 · 2024-04-22T07:47:41.000Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.