Vulnerabilities in dependencies - Githubissues

DP-3T / dp3t-sdk-backend

The backend implementation for DP3T

Mozilla Public License 2.0

199 stars 87 forks source link

Vulnerabilities in dependencies #249

Closed iCesofT closed 4 years ago

iCesofT commented 4 years ago

The current version has some vulnerabilities:

snakeyaml-1.25. CVE-2003-1564. https://cwe.mitre.org/data/definitions/397.html
tomcat-9.0.33. https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-570072
postgresql-42.2.11. https://snyk.io/vuln/SNYK-JAVA-ORGPOSTGRESQL-571481

I propose upgrading versions (https://github.com/DP-3T/dp3t-sdk-backend/pull/248) and also optimise the dependencies & plugins management.

martinalig commented 4 years ago

Closed by https://github.com/DP-3T/dp3t-sdk-backend/pull/250