This repository has been archived by the owner on Jan 19, 2024. It is now read-only.

Please consider upgrading three dependencies to mitigate several known CVEs #100

Open

sethb3214 opened this issue Oct 8, 2018 · 0 comments

sethb3214 commented Oct 8, 2018

Dependency vulnerability analysis shows that there are three dependencies in this project that appear to contain known CVEs. The dependencies are

bcprov-jdk15on-1.51.jar
cxf-rt-transports-http-3.1.2.jar
cxf-rt-ws-security-3.1.2.jar

Here are the Bouncy Castle CVEs:

Here are the Apache CXF Transport CVEs:

Here is the WS Security CVE:

CVE-2017-5656

While these libraries don't appear to be used by the Java FuelSDK, is it possible to upgrade these dependencies to a more secure version?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.