search

denimgroup / threadfix

ThreadFix is a software vulnerability management platform. This GitHub site is far out of date. Please go to www.threadfix.it for up-to-date information.
339 stars 127 forks source link

Study on OSS maven library vulnerabilities: httpclient library #1767

Open raux opened 7 years ago

raux commented 7 years ago

Dear Github OSS Developer,

My name is Raula Kula, a research assistant prof at Osaka University, Japan. Currently I am studying the maintenance of Maven Libraries. I am currently focused on OSS vulnerabilities and the varying reasons for library migration.

As a part of my study I particularity focused on the commons-httpclient library. http://hc.apache.org/httpclient-3.x/ and the CVE-2012-5783 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783, announced on 11/04/2012 and revisited 11/24/2015, which affects versions up to 3.x.

We noticed that your project on Github is still configured to depend on a vulnerable version of fileupload (3.1) at {https://github.com/denimgroup/threadfix/blob/master/pom.xml}

We understand that there are many reasons for not migrating, thus we be appreciate if you could simply detail the following:

  1. Were you aware of the vulnerability? If so, then how long ago.
  2. What are some factors that influence you not to update.
  3. Does you project employ a update strategy, to check and update versions of currently used libraries?

Also feel free to detail any other information to help us understand your decision. Again, thank you for taking your time off your busy schedule and hope to hear from you soon. Please note that we respect your confidentiality, so we will not disclose any personal details in the study.

Sincerely, Raula Kula