search

jgraph / docker-drawio

Dockerized draw.io based on whichever is the most secure image at the time.
GNU General Public License v3.0
1.49k stars 361 forks source link

[Security] Apache commons-text-1.9.jar contains CVE #96

Closed plinss closed 1 year ago

plinss commented 1 year ago

The docker image includes an instance of Apache's commons-text-1.9.jar which has a known CVE: https://commons.apache.org/proper/commons-text/security.html

It's not clear if this CVE is relevant as it only impacts code that uses the StringSubstitutor API without sanitization, but my org's file scanners are alerting about it.

davidjgraph commented 1 year ago

The next release does have an update, just need a trigger for the build process and this will update.

That said, we don't believe any of our code to be vulnerable.