[
https://issues.apache.org/jira/browse/FELIX-6230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17051066#comment-17051066
]
XuCongying commented on FELIX-6230:
-----------------------------------
Thanks for your suggestion. I'll do that next time.
> Vulnerable dependencies in your project.(CVEs)
> ----------------------------------------------
>
> Key: FELIX-6230
> URL: https://issues.apache.org/jira/browse/FELIX-6230
> Project: Felix
> Issue Type: Bug
> Reporter: XuCongying
> Priority: Major
>
> Hi,
> I found some CVEs in the library dependencies, which may affect the security
> of your projects. To prevent potential risk it may cause, I suggest a library
> update. See details below:
> Vulnerable Library Version: commons-collections : commons-collections : 3.2.1
> CVE ID:
> [CVE-2015-6420](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6420)
> Import Path: http/sslfilter/pom.xml, http/whiteboard/pom.xml
> Suggested Safe Versions: 20030418.083655, 20031027.000000, 20040102.233541,
> 20040616, 3.2.2
> Vulnerable Library Version: org.bouncycastle : bcpkix-jdk15on : 1.54
> CVE ID:
> [CVE-2017-13098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13098),
>
> [CVE-2016-1000341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341),
>
> [CVE-2018-1000613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613)
> Import Path: deploymentadmin/itest/pom.xml
> Suggested Safe Versions: 1.60, 1.61, 1.62, 1.63, 1.64
> Vulnerable Library Version: org.ops4j.pax.runner : pax-runner-no-jcl : 1.7.6
> CVE ID:
> [CVE-2012-5783](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783)
> Import Path: useradmin/itest/pom.xml
> Suggested Safe Versions: 1.9.0
> Vulnerable Library Version: xerces : xercesImpl : 2.9.1
> CVE ID:
> [CVE-2012-0881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881),
> [CVE-2013-4002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002)
> Import Path: ipojo/manipulator/maven-ipojo-plugin/pom.xml,
> ipojo/manipulator/ipojo-ant-task/pom.xml
> Suggested Safe Versions: 2.12.0
> Vulnerable Library Version: org.eclipse.jetty : jetty-util : 9.4.11.v20180605
> CVE ID:
> [CVE-2019-10246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10246),
>
> [CVE-2019-10241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241)
> Import Path: http/jetty/pom.xml
> Suggested Safe Versions: 10.0.0-alpha0, 10.0.0.alpha1, 9.4.17.v20190418,
> 9.4.18.v20190429, 9.4.19.v20190610, 9.4.20.v20190813, 9.4.21.v20190926,
> 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120, 9.4.25.v20191220,
> 9.4.26.v20200117
> Vulnerable Library Version: org.eclipse.jetty : jetty-util : 9.3.8.v20160314
> CVE ID:
> [CVE-2017-9735](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9735),
>
> [CVE-2019-10246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10246),
>
> [CVE-2019-10241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241),
>
> [CVE-2018-12536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12536)
> Import Path: http/cometd/pom.xml
> Suggested Safe Versions: 10.0.0-alpha0, 10.0.0.alpha1, 9.4.17.v20190418,
> 9.4.18.v20190429, 9.4.19.v20190610, 9.4.20.v20190813, 9.4.21.v20190926,
> 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120, 9.4.25.v20191220,
> 9.4.26.v20200117
> Vulnerable Library Version: org.apache.ant : ant : 1.7.0
> CVE ID:
> [CVE-2012-2098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098)
> Import Path: tools/org.apache.felix.scr.ant/pom.xml
> Suggested Safe Versions: 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5,
> 1.10.6, 1.10.7, 1.7.1, 1.8.4, 1.9.0, 1.9.1, 1.9.10, 1.9.11, 1.9.12, 1.9.13,
> 1.9.14, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.9.7, 1.9.8, 1.9.9
> Vulnerable Library Version: org.eclipse.jetty : jetty-client :
> 9.3.8.v20160314
> CVE ID:
> [CVE-2017-7657](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657),
>
> [CVE-2017-7658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658),
> [CVE-2017-7656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7656)
> Import Path: http/cometd/pom.xml
> Suggested Safe Versions: 10.0.0-alpha0, 10.0.0.alpha1, 9.4.11.v20180605,
> 9.4.12.RC0, 9.4.12.RC1, 9.4.12.RC2, 9.4.12.v20180830, 9.4.13.v20181111,
> 9.4.14.v20181114, 9.4.15.v20190215, 9.4.16.v20190411, 9.4.17.v20190418,
> 9.4.18.v20190429, 9.4.19.v20190610, 9.4.20.v20190813, 9.4.21.v20190926,
> 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120, 9.4.25.v20191220,
> 9.4.26.v20200117
> Vulnerable Library Version: org.codehaus.plexus : plexus-utils : 2.0.5
> CVE ID:
> [CVE-2017-1000487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000487)
> Import Path: ipojo/manipulator/maven-ipojo-plugin/pom.xml
> Suggested Safe Versions: 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21,
> 3.0.22, 3.0.23, 3.0.24, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0
> Vulnerable Library Version: org.codehaus.plexus : plexus-utils : 3.0.10
> CVE ID:
> [CVE-2017-1000487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000487)
> Import Path: tools/maven-bundle-plugin/pom.xml
> Suggested Safe Versions: 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21,
> 3.0.22, 3.0.23, 3.0.24, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0
> Vulnerable Library Version: ch.qos.logback : logback-core : 0.9.6
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: ipojo/runtime/core-it/ipojo-core-factory-test/pom.xml,
> ipojo/runtime/core-it/ipojo-core-handler-test/pom.xml...(The rest of the 34
> paths is hidden.)
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-core : 0.9.29
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: scr/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-core : 1.0.13
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: systemready/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-core : 1.1.3
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: deploymentadmin/itest/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-core : 0.9.20
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path:
> ipojo/handler/eventadmin/eventadmin-handler-it/src/it/event-admin-it/pom.xml,
> ipojo/handler/eventadmin/eventadmin-handler-it/pom.xml,
> ipojo/handler/jmx/jmx-handler-it/src/it/jmx-it/pom.xml,
> ipojo/handler/jmx/jmx-handler-it/pom.xml,
> ipojo/handler/temporal/temporal-dependency-handler-it/src/it/temporal-it/pom.xml,
> ipojo/handler/temporal/temporal-dependency-handler-it/pom.xml,
> ipojo/handler/transaction/transaction-handler-it/src/it/transaction-it/pom.xml,
> ipojo/handler/transaction/transaction-handler-it/pom.xml,
> ipojo/handler/whiteboard/whiteboard-handler-it/src/it/whiteboard-it/pom.xml,
> ipojo/handler/whiteboard/whiteboard-handler-it/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: org.ops4j.pax.url : pax-url-aether : 1.6.0
> CVE ID:
> [CVE-2015-6748](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6748)
> Import Path: deploymentadmin/itest/pom.xml
> Suggested Safe Versions: 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1, 2.4.2,
> 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4,
> 2.6.0, 2.6.1, 2.6.2
> Vulnerable Library Version: com.h2database : h2 : 1.3.171
> CVE ID:
> [CVE-2018-10054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10054),
>
> [CVE-2018-14335](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14335)
> Import Path: examples/jaas/jdbc-h2/pom.xml
> Suggested Safe Versions: 1.4.198, 1.4.199, 1.4.200
> Vulnerable Library Version: org.eclipse.jetty : jetty-server :
> 9.4.11.v20180605
> CVE ID:
> [CVE-2019-10247](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10247)
> Import Path: http/jetty/pom.xml
> Suggested Safe Versions: 10.0.0-alpha0, 10.0.0.alpha1, 9.4.17.v20190418,
> 9.4.18.v20190429, 9.4.19.v20190610, 9.4.20.v20190813, 9.4.24.v20191120,
> 9.4.25.v20191220, 9.4.26.v20200117
> Vulnerable Library Version: commons-fileupload : commons-fileupload : 1.3.2
> CVE ID:
> [CVE-2016-1000031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031)
> Import Path: webconsole-plugins/subsystems/pom.xml,
> webconsole-plugins/deppack/pom.xml, webconsole-plugins/script-console/pom.xml
> Suggested Safe Versions: 1.3.3, 1.4
> Vulnerable Library Version: commons-fileupload : commons-fileupload : 1.2.1
> CVE ID:
> [CVE-2013-2186](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2186),
>
> [CVE-2016-3092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092),
>
> [CVE-2014-0050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050),
>
> [CVE-2016-1000031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031),
> [CVE-2013-0248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0248)
> Import Path: webconsole/pom.xml
> Suggested Safe Versions: 1.3.3, 1.4
> Vulnerable Library Version: commons-fileupload : commons-fileupload : 1.2.2
> CVE ID:
> [CVE-2013-2186](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2186),
>
> [CVE-2016-3092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092),
>
> [CVE-2014-0050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050),
>
> [CVE-2016-1000031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031),
> [CVE-2013-0248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0248)
> Import Path: ipojo/distributions/ipojo-webconsole-quicktart/pom.xml
> Suggested Safe Versions: 1.3.3, 1.4
> Vulnerable Library Version: org.apache.commons : commons-compress : 1.10
> CVE ID:
> [CVE-2018-11771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11771)
> Import Path:
> tools/maven-bundle-plugin/src/it/embed-multiple-artifacts/pom.xml,
> tools/maven-bundle-plugin/src/it/dep-reduced/pom.xml
> Suggested Safe Versions: 1.19, 1.20
> Vulnerable Library Version: org.apache.sling : org.apache.sling.api : 2.2.0
> CVE ID:
> [CVE-2015-2944](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2944)
> Import Path: tools/maven-scr-plugin/src/it/basic-build-it/pom.xml,
> tools/maven-scr-plugin/src/it/external-annotations-it/pom.xml
> Suggested Safe Versions: 2.11.0, 2.12.0, 2.14.0, 2.14.2, 2.15.0, 2.16.0,
> 2.16.2, 2.16.4, 2.18.0, 2.18.2, 2.18.4, 2.2.2, 2.2.4, 2.20.0, 2.21.0, 2.22.0,
> 2.3.0, 2.4.0, 2.4.2, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0
> Vulnerable Library Version: ch.qos.logback : logback-classic : 0.9.6
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: ipojo/runtime/core-it/ipojo-core-factory-test/pom.xml,
> ipojo/runtime/core-it/ipojo-core-handler-test/pom.xml...(The rest of the 34
> paths is hidden.)
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
>
> Vulnerable Library Version: ch.qos.logback : logback-classic : 0.9.29
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: scr/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-classic : 1.0.13
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: systemready/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-classic : 1.1.3
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path: deploymentadmin/itest/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: ch.qos.logback : logback-classic : 0.9.20
> CVE ID:
> [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
> Import Path:
> ipojo/handler/eventadmin/eventadmin-handler-it/src/it/event-admin-it/pom.xml,
> ipojo/handler/eventadmin/eventadmin-handler-it/pom.xml,
> ipojo/handler/jmx/jmx-handler-it/src/it/jmx-it/pom.xml,
> ipojo/handler/jmx/jmx-handler-it/pom.xml,
> ipojo/handler/temporal/temporal-dependency-handler-it/src/it/temporal-it/pom.xml,
> ipojo/handler/temporal/temporal-dependency-handler-it/pom.xml,
> ipojo/handler/transaction/transaction-handler-it/src/it/transaction-it/pom.xml,
> ipojo/handler/transaction/transaction-handler-it/pom.xml,
> ipojo/handler/whiteboard/whiteboard-handler-it/src/it/whiteboard-it/pom.xml,
> ipojo/handler/whiteboard/whiteboard-handler-it/pom.xml
> Suggested Safe Versions: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0,
> 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
> Vulnerable Library Version: org.codehaus.woodstox : woodstox-core-asl : 4.0.7
> CVE ID:
> [CVE-2013-2160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2160)
> Import Path: bundlerepository/pom.xml
> Suggested Safe Versions: 4.2.0, 4.2.1, 4.3.0, 4.4.0, 4.4.1
> Vulnerable Library Version: org.bouncycastle : bcprov-jdk15on : 1.54
> CVE ID:
> [CVE-2016-1000346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000346),
>
> [CVE-2018-1000613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613),
>
> [CVE-2015-6644](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6644),
>
> [CVE-2016-1000341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341),
>
> [CVE-2016-1000340](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340),
>
> [CVE-2016-1000342](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342),
>
> [CVE-2016-1000344](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344),
>
> [CVE-2016-1000343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343),
>
> [CVE-2018-5382](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5382),
>
> [CVE-2016-1000339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339),
>
> [CVE-2016-1000345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345),
>
> [CVE-2016-1000352](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352),
>
> [CVE-2016-1000338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338),
>
> [CVE-2017-13098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13098)
> Import Path: deploymentadmin/itest/pom.xml
> Suggested Safe Versions: 1.60, 1.61, 1.62, 1.64
> Vulnerable Library Version: org.eclipse.jetty : jetty-http : 9.3.8.v20160314
> CVE ID:
> [CVE-2018-12545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12545),
>
> [CVE-2017-7657](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657),
>
> [CVE-2017-7658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658),
> [CVE-2017-7656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7656)
> Import Path: http/cometd/pom.xml
> Suggested Safe Versions: 10.0.0-alpha0, 10.0.0.alpha1, 9.4.16.v20190411,
> 9.4.17.v20190418, 9.4.18.v20190429, 9.4.19.v20190610, 9.4.20.v20190813,
> 9.4.21.v20190926, 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120,
> 9.4.25.v20191220, 9.4.26.v20200117
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
