search

eirslett / frontend-maven-plugin

"Maven-node-grunt-gulp-npm-node-plugin to end all maven-node-grunt-gulp-npm-plugins." A Maven plugin that downloads/installs Node and NPM locally, runs NPM install, Grunt, Gulp and/or Karma.
Apache License 2.0
4.2k stars 868 forks source link

CVE-2024-25710 #1134

Open Janpopan opened 4 months ago

Janpopan commented 4 months ago

Do you want to request a feature or report a bug? Bug

CVE-2024-25710 is reported commons-compress-1.21 is used as a 3rd party lib

If the current behavior is a bug, please provide the steps to reproduce. use an OWASP Check toll or take a look at https://nvd.nist.gov/vuln/detail/CVE-2024-25710

What is the expected behavior? update commons-compress to 1.26.0

Please mention your frontend-maven-plugin and operating system version. frontend-maven-plugin 1.15.0

btw there are some more not uptodate 3rd party libs