[DIRKRB-757] CVE-2020-15250 vulnerability from the junit dependency in Kerby ASN1

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.1
• Fix Version/s: 2.0.2
• Component/s: has-project
• Flags: Important
• Assignee: Unassigned
• Reporter: Thamindu Jayawickrama
• Created: 18/Mar/22 04:14
• Updated: 09/May/22 07:45
• Resolved: 21/Apr/22 20:47

Description

Kerby asn1 2.0.1 uses the junit 4.13 version which has a direct vulnerability of CVE-2020-15250.

https://mvnrepository.com/artifact/org.apache.kerby/kerby-asn1/2.0.1

The project has been already updated with the junit version 4.13.2 which doesn't have any detected vulnerabilities.

https://github.com/apache/directory-kerby/blob/trunk/pom.xml#L56

 

Can we expect a release with the updated junit version?