Potential vulnerabilities due to libraries. - Githubissues

alpha-asp / Alpha

A lazy-grounding Answer-Set Programming system

BSD 2-Clause "Simplified" License

58 stars 10 forks source link

Potential vulnerabilities due to libraries. #362

Closed AntoniusWeinzierl closed 9 months ago

AntoniusWeinzierl commented 1 year ago

The following CVEs are reported for some currently used libraries that Alpha is depending on transitively:

CVE-2018-10237 (medium severity) for google guava before version 24.1.1
CVE-2020-8908 (low severity) for google guava before version 30.0
CVE-2022-42889 (high severity) for apache commons-text before version 1.10.0
CVE-2021-35515 (high severity) for apache commons-compress before version 1.21
CVE-2021-35516 (high severity) for apache commons-compress before version 1.21
CVE-2021-35517 (high severity) for apache commons-compress before version 1.21
CVE-2021-36090 (high severity) for apache commons-compress before version 1.21

Updating our dependencies would be appropriate.