Upgrade "guava" to version 30.0-android, 30.0-jre or higher to get rid of security vulnerability [CVE-2020-8908, CWE-200]

aaron-kumar commented 3 years ago

SAST tool reported vulnerability for library : guava

network.oxalis:oxalis-commons@5.0.1 ---com.google.inject:guice@4.2.2 ------com.google.guava:guava@25.1-android

com.basware:oxalis-standalone@1.0 ---network.oxalis:oxalis-outbound@5.0.1 ------network.oxalis.vefa:peppol-lookup@2.0.1 ---------com.google.guava:guava@29.0-jre

network.oxalis:oxalis-war@5.0.1 ---network.oxalis:oxalis-inbound@5.0.1 ------com.google.guava:guava@28.2-jre

Library "com.google.guava:guava" need to version 30.0-android, 30.0-jre or higher

aaron-kumar commented 2 years ago

Fixed with commit : d2e137dfe8cf207416e4dcee10ada19583e8368f

aaron-kumar commented 2 years ago

Fixed vulnerability in Oxalis release v5.0.6

OxalisCommunity / oxalis

Upgrade "guava" to version 30.0-android, 30.0-jre or higher to get rid of security vulnerability [CVE-2020-8908, CWE-200] #531