search

DeBortoliWines / openerp-java-api

A Java API to connect to OpenERP and manage data using the XMLRPC interface.
Apache License 2.0
38 stars 71 forks source link

Vulnerable dependency xmlrpc-common-3.1.3.jar: CVE-2016-5002 #48

Open concernedrat opened 6 years ago

concernedrat commented 6 years ago

A quick security check on the dependencies thrown a high (CVSS >= 8) for xmlrpc-common.

I will submit a patch (major update) to this project to swap the xmlrpc client for a non-vulnerable xmlrpc client

concernedrat commented 6 years ago

Planning to use this lib:

https://github.com/gturri/aXMLRPC

Any suggestions are greatly appreciated.

flotho commented 6 years ago

Hi @georgerb , Thanks for your proposal. This point has been pointed out by Pentaho Team https://github.com/DeBortoliWines/openerp-java-api/issues/43 . So great idea.