search

exasol / cloud-storage-extension

Exasol Cloud Storage Extension for accessing formatted data Avro, Orc and Parquet, on public cloud storage systems
MIT License
7 stars 11 forks source link

Dependency Check Fails #245

Closed morazow closed 1 year ago

morazow commented 1 year ago

From recent Github Actions:

Error:  Failed to execute goal org.sonatype.ossindex.maven:ossindex-maven-plugin:3.2.0:audit (default-cli) on project cloud-storage-extension: Detected 3 vulnerable components:
Error:    org.apache.spark:spark-core_2.13:jar:3.3.2:compile; https://ossindex.sonatype.org/component/pkg:maven/org.apache.spark/spark-core_2.13@3.3.2?utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:      * [CVE-2023-22946] CWE-269: Improper Privilege Management (9.9); https://ossindex.sonatype.org/vulnerability/CVE-2023-22946?component-type=maven&component-name=org.apache.spark%2Fspark-core_2.13&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:    org.eclipse.jetty:jetty-util:jar:9.4.48.v20220622:compile; https://ossindex.sonatype.org/component/pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622?utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:      * [CVE-2023-26048] CWE-770: Allocation of Resources Without Limits or Throttling (5.3); https://ossindex.sonatype.org/vulnerability/CVE-2023-26048?component-type=maven&component-name=org.eclipse.jetty%2Fjetty-util&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:    com.google.guava:guava:jar:31.1-jre:compile; https://ossindex.sonatype.org/component/pkg:maven/com.google.guava/guava@31.1-jre?utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:      * [CVE-2020-8908] CWE-379: Creation of Temporary File in Directory with Incorrect Permissions (6.2); https://ossindex.sonatype.org/vulnerability/CVE-2020-8908?component-type=maven&component-name=com.google.guava%2Fguava&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:  
Error:  Excluded vulnerabilities:
Error:    - [CVE-2019-10172] CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (7.5); https://ossindex.sonatype.org/vulnerability/CVE-2019-10172?component-type=maven&component-name=org.codehaus.jackson%2Fjackson-mapper-asl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:    - [CVE-2020-36641] CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (9.8); https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
Error:    - [CVE-2017-7525] CWE-184: Incomplete Blacklist (9.8); https://ossindex.sonatype.org/vulnerability/CVE-2017-7525?component-type=maven&component-name=org.codehaus.jackson%2Fjackson-mapper-asl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1