[NIFI-5957] 74 high severity CVEs in nifi 1.8.0 - third party dependency libraries

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.7.1
• Component/s: Core Framework, Security
• Labels: security
• Environment: Inserted OWASP Dependency Check plugin into nifi pom.xml & ran report
• Assignee: Unassigned
• Reporter: Albert Baker
• Created: 15/Jan/19 15:43
• Updated: 27/Apr/21 13:29
• Resolved: 27/Apr/21 13:29

Description

There are 74 High severity CVEs in nifi 1.8.0 according to OWASP Dependency check.

There is a possibility of a few false positives with this report, /but/ there is the commons-collections:commons-collections:3.2.1 issue which there is proof-of-concept exploit code out for for three years.    These dependencies need to be cleaned up.