Hi Swagatika, This issue is already addressed in the latest development code and will be included in the next POI release.
https://poi.apache.org/changes.html -- see the refernce to upgrading to xmlsec 2.1.5 Regards, PJ On Tuesday 7 April 2020, 16:24:33 GMT+2, Swagatika Pati <[email protected]> wrote: Hi Team I am using apache poi-ooxml-4.1.2.jar for our developmentpurpose for a Java based application. But while doing black duck scanning we got the below vulnerabilitiesfor Apache-XML Xml Security componentused in poi-ooxml-4.1.2.jar. The below classes used the Apache-XML Xml Security component in their import statements poi-ooxml-4.1.2.jar/org/apache/poi/poifs/crypt/dsig/SignatureConfig.class poi-ooxml-4.1.2.jar/org/apache/poi/poifs/crypt/dsig/facets/KeyInfoSignatureFacet.class poi-ooxml-4.1.2.jar/org/apache/poi/poifs/crypt/dsig/facets/XAdESXLSignatureFacet.class poi-ooxml-4.1.2.jar/org/apache/poi/poifs/crypt/dsig/services/RelationshipTransformService.class And below are the list of vulnerabilities IDS. CVE-2014-8152, CVE-2013-4517, CVE-2013-2210, CVE-2013-2172, CVE-2013-2156, CVE-2013-2155, CVE-2013-2154, CVE-2013-2153, CVE-2011-2516 Can you please guide us how to resolve this vulnerabilities . Thanks,Swagatika --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
