[MWAR-456] Latest maven-war-plugin causing vulnerable .jars to be downloaded

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.3.2
• Fix Version/s: 3.4.0
• Environment: Linux, Windows
• Flags: Patch, Important

Language

Java

• Assignee: Dennis Lundberg
• Reporter: Joseph Angotti
• Created: 12/Sep/22 14:35
• Updated: 15/Oct/22 18:18
• Resolved: 15/Oct/22 18:18

Description

We are planning to upgrade our project's parent pom.xml file to use maven-war-plugin 3.3.2, which is the latest version, but somehow it is causing 2 vulnerable .jar files, plexus-utils-2.0.5.jar, and maven-shared-utils-3.2.1.jar, to download from our JFrog Artifactory repository when it shouldn't be. Other versions of the maven-war-plugin seem to result in the same issue.

Is there someone available who can assist with this issue as soon as possible? Our development efforts are currently blocked because of this issue. We need to be able to upgrade to the latest version of the maven-war-plugin and prevent vulnerable .jar files from being downloaded as soon as possible before our remediation deadline in a few weeks. Thank you (see the maven console logs attached for more details).