Merge remote-tracking branch 'origin/fix/PRODSEC-9150-snappy-vulnerability' into fix/PRODSEC-9150-snappy-vulnerability

[PRODSEC-9150] fix for snappy vulnerability
Fix/prodsec 8957 spring context vulnerability (#674 )
2026-09-16 18:13:23 +00:00 · 2024-06-17 14:26:57 +05:30 · 2024-06-17 14:26:05 +05:30 · 2024-06-17 11:16:44 +05:30 · 2024-06-17 10:41:50 +05:30 · 2024-06-13 15:40:20 +05:30
2 changed files with 23 additions and 18 deletions
@@ -38,7 +38,7 @@
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
-            <version>3.2.17.RELEASE</version>
+            <version>5.3.37</version>
        </dependency>

        <!-- Access to JUnit runner classes -->
@@ -17,7 +17,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-plugin</artifactId>
-                <version>3.9.0</version>
+                <version>3.5</version>
                <executions>
                    <execution>
                        <id>generated-helpmojo</id>
@@ -81,7 +81,7 @@
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-archiver</artifactId>
-            <version>3.1.1</version>
+            <version>3.6.0</version>
            <exclusions>
                <exclusion>
                    <artifactId>maven-core</artifactId>
@@ -92,7 +92,18 @@
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-archiver</artifactId>
-            <version>3.4</version>
+            <version>4.9.2</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.iq80.snappy</groupId>
+                    <artifactId>snappy</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.iq80.snappy</groupId>
+            <artifactId>snappy</artifactId>
+            <version>0.5</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
@@ -102,7 +113,7 @@
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
-            <version>3.2.5</version>
+            <version>3.9.7</version>
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
@@ -112,7 +123,7 @@
        <dependency>
            <groupId>commons-net</groupId>
            <artifactId>commons-net</artifactId>
-            <version>3.6</version>
+            <version>3.10.0</version>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
@@ -127,18 +138,12 @@
        <dependency>
            <groupId>org.alfrescolabs.alfresco-technical-validation</groupId>
            <artifactId>org.alfrescolabs.alfresco-technical-validation</artifactId>
-            <version>0.4.0</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>ch.qos.logback</groupId>
-                    <artifactId>logback-classic</artifactId>
-                </exclusion>
-            </exclusions>
+            <version>0.6.0</version>
        </dependency>
        <dependency>
-            <groupId>ch.qos.logback</groupId>
-            <artifactId>logback-classic</artifactId>
-            <version>1.5.6</version>
+            <groupId>commons-lang</groupId>
+            <artifactId>commons-lang</artifactId>
+            <version>2.6</version>
        </dependency>
        <dependency>
            <groupId>org.twdata.maven</groupId>
@@ -149,7 +154,7 @@
        <dependency>
            <groupId>org.zeroturnaround</groupId>
            <artifactId>zt-zip</artifactId>
-            <version>1.11</version>
+            <version>1.17</version>
        </dependency>
        <dependency>
            <groupId>de.schlichtherle.truezip</groupId>
@@ -163,7 +168,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-plugin</artifactId>
-                <version>3.9.0</version>
+                <version>3.5</version>
            </plugin>
        </plugins>
    </reporting>
Author	SHA1	Message	Date
pmm	a84410ae98	Merge remote-tracking branch 'origin/fix/PRODSEC-9150-snappy-vulnerability' into fix/PRODSEC-9150-snappy-vulnerability	2024-06-17 14:26:57 +05:30
pmm	f7e940c25e	[PRODSEC-9150] fix for snappy vulnerability	2024-06-17 14:26:05 +05:30
purusothaman-mm	459e3f1424	Fix/prodsec 8957 spring context vulnerability (#674 ) * [PRODSEC-8957] fix for spring-context * [PRODSEC-8957] fix for spring-context * [PRODSEC-8957] fix for spring-context * [PRODSEC-8957] fix for spring-context	2024-06-17 11:16:44 +05:30
pmm	a5bf649afb	[PRODSEC-9150] fix for snappy vulnerability	2024-06-17 10:41:50 +05:30
purusothaman-mm	a879ad83c9	[PRODSEC-9063] fix for maven-shared-utils (#672 )	2024-06-13 15:40:20 +05:30
purusothaman-mm	928f99336e	[PRODSEC-8961] fix for commons-net vulnerability (#671 )	2024-06-12 18:15:21 +05:30
purusothaman-mm	9521f6ef42	[PRODSEC-9043] fix for maven-core vulnerability (#669 )	2024-06-11 16:50:41 +05:30
purusothaman-mm	0a0039dcb0	[PRODSEC-8959] fix for zt-zip vulnerability (#668 )	2024-06-07 13:22:30 +05:30
purusothaman-mm	2c29c915d4	fix for alfresco security issues (#667 )	2024-05-31 15:41:28 +05:30
Manish Kumar	7878155ed9	[PRODSEC-9051] updated plexus archiver version from 3.4 to 4.9.2 (#666 )	2024-05-28 12:40:18 +05:30
pmm	7aa6400210	Revert "[PRODSEC-9046] fix for sdk vulnerability (#665 )" This reverts commit `cc0955e012`.	2024-05-27 15:14:03 +05:30
purusothaman-mm	cc0955e012	[PRODSEC-9046] fix for sdk vulnerability (#665 )	2024-05-22 14:41:47 +05:30