[MSITE-830] Dependency upgrades related to identified security reports

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.8.2
• Assignee: Sylwester Lachiewicz
• Reporter: Sylwester Lachiewicz
• Created: 14/Nov/18 16:36
• Updated: 25/Jul/19 08:20
• Resolved: 10/Jun/19 20:48

Description

Fix problems reported by Snyk.io
 

H	Arbitrary File Write via Archive Extraction (Zip Slip) in org.codehaus.plexus:plexus-archiver
H	Arbitrary Code Execution in commons-beanutils:commons-beanutils
H	Arbitrary Code Execution in commons-collections:commons-collections
H	XML External Entity (XXE) Injection in dom4j:dom4j
H	Denial of Service (DoS) in org.apache.pdfbox:fontbox
H	Arbitrary Code Injection in org.apache.struts:struts-core
H	Arbitrary Command Execution in org.mortbay.jetty:jetty
M	Denial of Service (DoS) in org.apache.commons:commons-compress
M	Directory Traversal in org.apache.commons:commons-compress
M	Man-in-the-Middle (MitM) in org.apache.httpcomponents:httpclient
M	Directory Traversal in org.apache.httpcomponents:httpclient
M	Improper Input Validation in org.apache.httpcomponents:httpclient
M	Information Exposure in org.apache.httpcomponents:httpclient
M	Denial of Service (DoS) in org.apache.httpcomponents:httpclient
M	Denial of Service (DoS) in org.apache.pdfbox:pdfbox
L	Denial of Service (DoS) in org.apache.commons:commons-compress

Issue Links

• is related to: MSITE-837 use an embedded http server that is light and requires just Java 7
• relates to: MSITE-828 Upgrade to Java 8
• relates to: MSITE-829 Upgrade Jetty to 9.4.x
• relates to: MSITE-843 Update Jetty to 9.2.28
• requires: MSITE-839 Upgrade to Maven Doxia (Sitetools) 1.9