[
https://issues.apache.org/jira/browse/MNG-6872?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17055232#comment-17055232
]
Karl Heinz Marbaise commented on MNG-6872:
------------------------------------------
Done in
[9e92a93ab83e4fc8bc2fd9544198b735ed92d678|https://gitbox.apache.org/repos/asf?p=maven.git;a=commitdiff;h=9e92a93ab83e4fc8bc2fd9544198b735ed92d678]
> Found CVEs in your dependencies - plexus-utils (tests)
> ------------------------------------------------------
>
> Key: MNG-6872
> URL: https://issues.apache.org/jira/browse/MNG-6872
> Project: Maven
> Issue Type: Dependency upgrade
> Affects Versions: 3.6.3
> Reporter: XuCongying
> Assignee: Karl Heinz Marbaise
> Priority: Minor
> Fix For: 3.7.0
>
>
> I noticed some of your libraries contained CVEs. I suggest a library update
> to avoid potential risks. See below for more details:
>
> Vulnerable Library Version: org.codehaus.plexus : plexus-utils : 1.5.5
> CVE ID:
> [CVE-2017-1000487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000487)
> Import Path:
> maven-core/src/test/resources-project-builder/micromailer/pom.xml
> Suggested Safe Versions: 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21,
> 3.0.22, 3.0.23, 3.0.24, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
