[FELIX-6721] CVE-2021-33813: Upgrade jdom to the latest version in maven-bundle-plugin

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: maven-bundle-plugin-5.1.9
• Fix Version/s: maven-bundle-plugin-6.0.0
• Component/s: Maven Bundle Plugin
• Assignee: Paul Rütter
• Reporter: Xilai Dai
• Created: 23/Jul/24 03:44
• Updated: 3 days ago 06:33
• Resolved: 01/Dec/24 10:13

Description

There is a HIGH CVE https://nvd.nist.gov/vuln/detail/CVE-2021-33813 detected in the maven-bundle-plugin.

https://github.com/apache/felix-dev/blob/master/tools/maven-bundle-plugin/pom.xml#L274
<dependency>
<groupId>org.jdom</groupId>
<artifactId>jdom</artifactId>
<version>1.1</version>
</dependency>

The latest jdom2/2.0.6.1 (https://search.maven.org/artifact/org.jdom/jdom2/2.0.6.1/jar) is the fix version for it.