[FELIX-6193] Update maven-archiver + plexus-utils

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: maven-bundle-plugin-5.1.1
• Component/s: Maven Bundle Plugin
• Assignee: Jean-Baptiste Onofré
• Reporter: Colm O hEigeartaigh
• Created: 17/Oct/19 15:19
• Updated: 23/Mar/21 09:44
• Resolved: 15/Mar/20 10:53

Description

We should update the versions of maven-archiver + plexus-utils in the maven-bundle-plugin to remove the CVEs:

plexus-archiver-2.8.1.jar (pkg:maven/org.codehaus.plexus/plexus-archiver@2.8.1, cpe:2.3:a:plexus-archiver_project:plexus-archiver:2.8.1:::::::*) : CVE-2018-1002200
plexus-utils-3.0.10.jar (pkg:maven/org.codehaus.plexus/plexus-utils@3.0.10, cpe:2.3:a:plexus-utils_project:plexus-utils:3.0.10:::::::*) : CVE-2017-1000487, Directory traversal in org.codehaus.plexus.util.Expand, Possible XML Injection

Issue Links

• relates to: FELIX-6312 Maven Bundle Plugin removes entries from manifest since version 5
• links to: GitHub Pull Request #8
• links to: Pull Request