jaedonP commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4337686773
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260,
CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable
versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test,
json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all
artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path
(test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >=
9.11. -->
+ <dependency>
+ <groupId>org.ow2.asm</groupId>
+ <artifactId>asm</artifactId>
+ <version>${version.org.ow2.asm}</version>
+ </dependency>
Review Comment:
@yesamer
The asm-bom import approach turned out not to be viable in this context.
Maven's <scope>import</scope> BOM resolution is strictly first-declaration-wins
between BOMs, but explicit <dependencyManagement> entries always take
precedence over any BOM import regardless of position. Since infinispan-bom,
jetty-bom, and other BOMs in kie-parent transitively bring in their own ASM
version pins, the asm-bom import was overridden by them even when placed first.
The individual explicit entries are the only reliable mechanism to pin these
versions across all transitive paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
