inteligr8/SearchServices
1
0
Fork 0
mirror of https://github.com/Alfresco/SearchServices.git synced 2026-09-16 18:12:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

[ACS-11725][PRODSEC-11932][PRODSEC-12224][PRODSEC-12225][PRODSEC-12226][PRODSEC-11826]: CVE Vulnerabilities in Insight Engine 2 (#2259)

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Vivek Kumar
2026-05-22 20:11:43 +05:30
committed by GitHub
co-authored by Copilot Autofix powered by AI
parent cb5080bd9c
commit 95fa8475a0
3 changed files with 44 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pom.xml
+4 -4
View File
@@ -74,7 +74,7 @@
<dependency.calcite.version>1.32.0</dependency.calcite.version> <dependency.calcite.version>1.32.0</dependency.calcite.version>
<dependency.slf4j.version>1.7.36</dependency.slf4j.version> <dependency.slf4j.version>1.7.36</dependency.slf4j.version>
<dependency.cxf.version>3.6.6</dependency.cxf.version> <dependency.cxf.version>4.2.1</dependency.cxf.version>
<dependency.javax.servlet.api.version>3.1.0</dependency.javax.servlet.api.version> <dependency.javax.servlet.api.version>3.1.0</dependency.javax.servlet.api.version>
@@ -88,7 +88,7 @@
<dependency.commons-fileupload.version>1.6.0</dependency.commons-fileupload.version> <dependency.commons-fileupload.version>1.6.0</dependency.commons-fileupload.version>
<dependency.commons-io.version>2.15.1</dependency.commons-io.version> <dependency.commons-io.version>2.15.1</dependency.commons-io.version>
<dependency.commons-codec.version>1.16.1</dependency.commons-codec.version> <dependency.commons-codec.version>1.16.1</dependency.commons-codec.version>
<dependency.spring.version>6.2.12</dependency.spring.version> <dependency.spring.version>7.0.7</dependency.spring.version>
<dependency.spring-e2e-test.version>5.3.39</dependency.spring-e2e-test.version> <dependency.spring-e2e-test.version>5.3.39</dependency.spring-e2e-test.version>
<dependency.zookeeper.version>3.4.14</dependency.zookeeper.version> <dependency.zookeeper.version>3.4.14</dependency.zookeeper.version>
<dependency.mime4j.version>0.8.11</dependency.mime4j.version> <dependency.mime4j.version>0.8.11</dependency.mime4j.version>
@@ -250,7 +250,7 @@
<dependency> <dependency>
<groupId>org.apache.cxf</groupId> <groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-transports-http</artifactId> <artifactId>cxf-rt-transports-http</artifactId>
<version>4.0.5</version> <version>${dependency.cxf.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.cxf</groupId> <groupId>org.apache.cxf</groupId>
@@ -266,7 +266,7 @@
<groupId>org.apache.cxf</groupId> <groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-wsdl</artifactId> <artifactId>cxf-rt-wsdl</artifactId>
<version>${dependency.cxf.version}</version> <version>${dependency.cxf.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.commons</groupId> <groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId> <artifactId>commons-lang3</artifactId>
search-services/alfresco-search/pom.xml
+6 -6
View File
@@ -650,8 +650,8 @@
</excludes> </excludes>
</configuration> </configuration>
<executions> <executions>
<!-- Prepares the property pointing to the JaCoCo runtime agent which <!-- Prepares the property pointing to the JaCoCo runtime agent which
is passed as VM argument when Maven the Surefire plugin is executed. --> is passed as VM argument when Maven the Surefire plugin is executed. -->
<execution> <execution>
<id>pre-unit-test</id> <id>pre-unit-test</id>
@@ -661,13 +661,13 @@
<configuration> <configuration>
<!-- Sets the path to the file which contains the execution data. --> <!-- Sets the path to the file which contains the execution data. -->
<destFile>${project.build.directory}/coverage-reports/jacoco-ut.exec</destFile> <destFile>${project.build.directory}/coverage-reports/jacoco-ut.exec</destFile>
<!-- Sets the name of the property containing the settings for JaCoCo <!-- Sets the name of the property containing the settings for JaCoCo
runtime agent. --> runtime agent. -->
<propertyName>surefireArgLine</propertyName> <propertyName>surefireArgLine</propertyName>
</configuration> </configuration>
</execution> </execution>
<!-- Ensures that the code coverage report for unit tests is created after <!-- Ensures that the code coverage report for unit tests is created after
unit tests have been run. --> unit tests have been run. -->
<execution> <execution>
<id>post-unit-test</id> <id>post-unit-test</id>
@@ -687,7 +687,7 @@
</execution> </execution>
</executions> </executions>
</plugin> </plugin>
</plugins> </plugins>
</build> </build>
</project> </project>
search-services/packaging/src/main/resources/licenses/notice.txt
+34 -29
View File
@@ -1,9 +1,9 @@
Copyright (c) 2005-2023 Alfresco Software, Ltd. and others. Copyright (c) 2005-2023 Alfresco Software, Ltd. and others.
All rights reserved. This program and the accompanying materials are made available under the terms of the Alfresco All rights reserved. This program and the accompanying materials are made available under the terms of the Alfresco
agreement located at www.alfresco.com/legal/agreements/ or other commercial agreement between Alfresco Software, Ltd. agreement located at www.alfresco.com/legal/agreements/ or other commercial agreement between Alfresco Software, Ltd.
("Alfresco") and the user of this program. ("Alfresco") and the user of this program.
Portions of this product distribution require certain copyright or other notices to Portions of this product distribution require certain copyright or other notices to
be included with the product distribution. These notices may also appear in individual be included with the product distribution. These notices may also appear in individual
source files. source files.
Below is the list of licenses and modules used under corresponding licenses. Licenses for libraries used by Apache Solr are listed separately. Below is the list of licenses and modules used under corresponding licenses. Licenses for libraries used by Apache Solr are listed separately.
@@ -35,25 +35,26 @@ j2objc-annotations-3.0.0.jar https://github.com/google/j2objc
json-path-2.9.0.jar https://github.com/json-path/JsonPath json-path-2.9.0.jar https://github.com/json-path/JsonPath
json-simple-1.1.1.jar https://github.com/fangyidong/json-simple json-simple-1.1.1.jar https://github.com/fangyidong/json-simple
apiguardian-api-1.1.2.jar https://github.com/apiguardian-team/apiguardian apiguardian-api-1.1.2.jar https://github.com/apiguardian-team/apiguardian
jspecify-1.0.0.jar https://jspecify.dev/
xml-resolver-1.2.jar https://github.com/FasterXML/jackson xml-resolver-1.2.jar https://github.com/FasterXML/jackson
neethi-3.2.1.jar http://ws.apache.org/commons/neethi/ neethi-3.2.2.jar http://ws.apache.org/commons/neethi/
commons-logging-1.2.jar http://jakarta.apache.org/commons/ commons-logging-1.2.jar http://jakarta.apache.org/commons/
commons-lang3-3.18.0.jar http://jakarta.apache.org/commons/ commons-lang3-3.18.0.jar http://jakarta.apache.org/commons/
commons-compress-1.26.1.jar https://commons.apache.org/proper/commons-compress/ commons-compress-1.26.1.jar https://commons.apache.org/proper/commons-compress/
chemistry-opencmis-commons-impl-1.1.0.jar http://chemistry.apache.org/ chemistry-opencmis-commons-impl-1.1.0.jar http://chemistry.apache.org/
chemistry-opencmis-commons-api-1.1.0.jar http://chemistry.apache.org/ chemistry-opencmis-commons-api-1.1.0.jar http://chemistry.apache.org/
xmlschema-core-2.3.1.jar http://ws.apache.org/commons/XmlSchema/ xmlschema-core-2.3.2.jar http://ws.apache.org/commons/XmlSchema/
HikariCP-java7-2.4.13.jar https://github.com/brettwooldridge/HikariCP HikariCP-java7-2.4.13.jar https://github.com/brettwooldridge/HikariCP
cxf-core-3.6.6.jar https://cxf.apache.org/ cxf-core-4.2.1.jar https://cxf.apache.org/
cxf-rt-bindings-soap-3.6.6.jar https://cxf.apache.org/ cxf-rt-bindings-soap-4.2.1.jar https://cxf.apache.org/
cxf-rt-bindings-xml-3.6.6.jar https://cxf.apache.org/ cxf-rt-bindings-xml-4.2.1.jar https://cxf.apache.org/
cxf-rt-databinding-jaxb-3.6.6.jar https://cxf.apache.org/ cxf-rt-databinding-jaxb-4.2.1.jar https://cxf.apache.org/
cxf-rt-frontend-jaxws-3.6.6.jar https://cxf.apache.org/ cxf-rt-frontend-jaxws-4.2.1.jar https://cxf.apache.org/
cxf-rt-frontend-simple-3.6.6.jar https://cxf.apache.org/ cxf-rt-frontend-simple-4.2.1.jar https://cxf.apache.org/
cxf-rt-transports-http-4.0.5.jar https://cxf.apache.org/ cxf-rt-transports-http-4.2.1.jar https://cxf.apache.org/
cxf-rt-ws-addr-3.6.6.jar https://cxf.apache.org/ cxf-rt-ws-addr-4.2.1.jar https://cxf.apache.org/
cxf-rt-ws-policy-3.6.6.jar https://cxf.apache.org/ cxf-rt-ws-policy-4.2.1.jar https://cxf.apache.org/
cxf-rt-wsdl-3.6.6.jar https://cxf.apache.org/ cxf-rt-wsdl-4.2.1.jar https://cxf.apache.org/
chemistry-opencmis-server-support-1.0.0.jar http://chemistry.apache.org/ chemistry-opencmis-server-support-1.0.0.jar http://chemistry.apache.org/
chemistry-opencmis-server-bindings-1.0.0.jar http://chemistry.apache.org/ chemistry-opencmis-server-bindings-1.0.0.jar http://chemistry.apache.org/
failureaccess-1.0.2.jar https://mvnrepository.com/artifact/com.google.guava/failureaccess/1.0.2 failureaccess-1.0.2.jar https://mvnrepository.com/artifact/com.google.guava/failureaccess/1.0.2
@@ -63,17 +64,16 @@ jackson-core-2.17.2.jar https://github.com/FasterXML/jackson
jackson-annotations-2.17.2.jar https://github.com/FasterXML/jackson jackson-annotations-2.17.2.jar https://github.com/FasterXML/jackson
jackson-databind-2.17.2.jar https://github.com/FasterXML/jackson jackson-databind-2.17.2.jar https://github.com/FasterXML/jackson
commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/ commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/
spring-beans-6.2.12.jar http://projects.spring.io/spring-framework/ spring-beans-7.0.7.jar http://projects.spring.io/spring-framework/
spring-context-6.2.12.jar http://projects.spring.io/spring-framework/ spring-context-7.0.7.jar http://projects.spring.io/spring-framework/
spring-core-6.2.12.jar http://projects.spring.io/spring-framework/ spring-core-7.0.7.jar http://projects.spring.io/spring-framework/
spring-expression-6.2.12.jar http://projects.spring.io/spring-framework/ spring-expression-7.0.7.jar http://projects.spring.io/spring-framework/
spring-tx-6.2.12.jar http://projects.spring.io/spring-framework/ spring-tx-7.0.7.jar http://projects.spring.io/spring-framework/
guessencoding-1.4.jar http://docs.codehaus.org/display/GUESSENC/ guessencoding-1.4.jar http://docs.codehaus.org/display/GUESSENC/
jug-2.0.0-asl.jar http://jug.safehaus.org/ jug-2.0.0-asl.jar http://jug.safehaus.org/
acegi-security-0.8.2_patched.jar http://sourceforge.net/projects/acegisecurity/ acegi-security-0.8.2_patched.jar http://sourceforge.net/projects/acegisecurity/
jetty-continuation-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-continuation-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-deploy-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-deploy-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-http-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-io-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-io-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-jmx-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-jmx-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-rewrite-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-rewrite-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
@@ -84,7 +84,8 @@ jetty-servlets-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-util-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-util-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-webapp-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-webapp-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
jetty-xml-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html jetty-xml-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
woodstox-core-6.6.2.jar https://github.com/FasterXML/woodstox jetty-http-9.4.57.v20241219.jar https://www.eclipse.org/jetty/licenses.html
woodstox-core-7.1.1.jar https://github.com/FasterXML/woodstox
org.restlet-2.3.12.jar https://github.com/restlet/restlet-framework-java/blob/2.3.12/README.md org.restlet-2.3.12.jar https://github.com/restlet/restlet-framework-java/blob/2.3.12/README.md
org.restlet.ext.servlet-2.3.12.jar https://github.com/restlet/restlet-framework-java/blob/2.3.12/README.md org.restlet.ext.servlet-2.3.12.jar https://github.com/restlet/restlet-framework-java/blob/2.3.12/README.md
xercesImpl-2.12.2.jar http://www.apache.org/licenses/LICENSE-2.0.txt xercesImpl-2.12.2.jar http://www.apache.org/licenses/LICENSE-2.0.txt
@@ -97,6 +98,7 @@ gson-2.8.9.jar https://github.com/google/gson/blob/gson-parent-2.8.9/LICENSE
=== CDDL 1.1 === === CDDL 1.1 ===
jaxb-core-4.0.8.jar http://jaxb.java.net/
jaxb-core-4.0.3.jar http://jaxb.java.net/ jaxb-core-4.0.3.jar http://jaxb.java.net/
jaxb-xjc-4.0.3.jar http://jaxb.java.net/ jaxb-xjc-4.0.3.jar http://jaxb.java.net/
@@ -106,20 +108,23 @@ jakarta.activation-1.2.2.jar https://eclipse-ee4j.github.io/jaf
jakarta.activation-api-1.2.2.jar https://eclipse-ee4j.github.io/jaf jakarta.activation-api-1.2.2.jar https://eclipse-ee4j.github.io/jaf
jakarta.jws-api-2.1.0.jar https://projects.eclipse.org/projects/ee4j.websocket/releases/1.1.1 jakarta.jws-api-2.1.0.jar https://projects.eclipse.org/projects/ee4j.websocket/releases/1.1.1
jakarta.xml.bind-api-3.0.1.jar https://projects.eclipse.org/projects/ee4j.jaxb jakarta.xml.bind-api-3.0.1.jar https://projects.eclipse.org/projects/ee4j.jaxb
jakarta.xml.soap-api-1.4.2.jar https://projects.eclipse.org/projects/ee4j.jaxb jakarta.xml.soap-api-3.0.2.jar https://projects.eclipse.org/projects/ee4j.jaxb
jakarta.xml.ws-api-2.3.3.jar https://projects.eclipse.org/projects/ee4j.jaxb jakarta.xml.ws-api-4.0.3.jar https://projects.eclipse.org/projects/ee4j.jaxb
istack-commons-runtime-3.0.12.jar https://github.com/eclipse-ee4j/jaxb-istack-commons istack-commons-runtime-4.1.2.jar https://github.com/eclipse-ee4j/jaxb-istack-commons
txw2-2.3.5.jar https://eclipse-ee4j.github.io/jaxb-ri txw2-4.0.8.jar https://eclipse-ee4j.github.io/jaxb-ri
jaxb-runtime-2.3.5.jar https://github.com/eclipse-ee4j/jaxb-ri/blob/2.3.5-RI/LICENSE.md jaxb-runtime-4.0.8.jar https://github.com/eclipse-ee4j/jaxb-ri/blob/4.0.6/LICENSE.md
=== Eclipse Public License 1.0 === === Eclipse Public License 1.0 ===
=== Eclipse Public License 2.0 === === Eclipse Public License 2.0 ===
jakarta.annotation-api-1.3.5.jar https://projects.eclipse.org/projects/ee4j.ca jakarta.annotation-api-3.0.0.jar https://projects.eclipse.org/projects/ee4j.ca
jakarta.transaction-api-1.3.3.jar https://projects.eclipse.org/projects/ee4j.jta jakarta.transaction-api-1.3.3.jar https://projects.eclipse.org/projects/ee4j.jta
jakarta.mail-api-2.1.5.jar https://projects.eclipse.org/projects/ee4j.mail
jts-io-common-1.19.0.jar https://locationtech.github.io/jts/ jts-io-common-1.19.0.jar https://locationtech.github.io/jts/
jts-core-1.19.0.jar https://locationtech.github.io/jts/ jts-core-1.19.0.jar https://locationtech.github.io/jts/
angus-activation-2.0.3.jar https://eclipse-ee4j.github.io/angus-activation
angus-mail-2.0.5.jar https://eclipse-ee4j.github.io/angus-mail
=== BSD === === BSD ===
jibx-run-1.3.3.jar http://jibx.sourceforge.net/ jibx-run-1.3.3.jar http://jibx.sourceforge.net/