From 38decd34392e28e6836b85cb077ead97691997e3 Mon Sep 17 00:00:00 2001
From: Jan Vonka <jan.vonka@alfresco.com>
Date: Fri, 21 Sep 2018 17:24:58 +0100
Subject: [PATCH] ATS-132: Fix whitesource HIGH (security policy violation) -
 Alfresco Data Model 8.8 - transitive dependency (via opencmis client 1.0.0) -
 csxg-rt-transports-http 3.1.10 to 3.1.16 (for CVE-2018-8039 - CVSS 3 score of
 8.1)

---
 alfresco-docker-tika/pom.xml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/alfresco-docker-tika/pom.xml b/alfresco-docker-tika/pom.xml
index 71dc304f..1bfc90af 100644
--- a/alfresco-docker-tika/pom.xml
+++ b/alfresco-docker-tika/pom.xml
@@ -47,6 +47,17 @@
         <dependency>
             <groupId>org.alfresco</groupId>
             <artifactId>alfresco-data-model</artifactId>
+            <exclusion>
+                <groupId>org.apache.cxf</groupId>
+                <artifactId>cxf-rt-transports-http</artifactId>
+            </exclusion>
+        </dependency>
+
+        <!-- for Alfresco Data Model 8.8 (explicitly fix CVE) -->
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http</artifactId>
+            <version>3.1.16</version>
         </dependency>
 
         <dependency>
@@ -86,7 +97,7 @@
             </exclusions>
         </dependency>
 
-        <!-- for Apache Tika Parsers - eg. encrypted PDF -->
+        <!-- for Apache Tika Parsers 1.17-20180201-alfresco-patched (explicitly fix CVE) -->
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk15on</artifactId>