Re: maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Tamás Cservenák
Howdy, @Tomo it is happening, see this (using 3.8.6): https://gist.github.com/cstamas/3cecd1f521a92910a1f8555fc4aa9b17#file-gistfile1-txt-L38 Clean plugin 3.2.0 is okay, this is Maven doing it. In Maven 3.8.x line there is a legacy component doing it:

Re: maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Tomo Suzuki
Hi Martin, Would you share the output of your [1] setup, where you saw “plexus-utils-1.1.jar is being downloaded“? mvn -X -s settings.xml -Dmaven.repo.local=repository org.apache.maven.plugins:maven-clean-plugin:3.2.0:clean (Doesn’t the debug flag explain why it’s downloading it?) Regards,

maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Martin D'Aloia
Hi, we are seeing that even with the latest maven-clean-plugin (currently 3.2.0) a plexus-utils-1.1.jar is being downloaded. We think that it is a real issue but we wanted to check in case we are overlooking something. This is reproducible 100% with a simple setup shown below. [1] In theory