[SLING-10284] Dependency check fails on CVE-2015-2944 for Sling Resource Merger 1.4.0

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: Resource Merger 1.4.0
• Component/s: ResourceResolver
• Assignee: Unassigned
• Reporter: Henry Kuijpers
• Created: 09/Apr/21 09:38
• Updated: 09/Apr/21 12:57
• Resolved: 09/Apr/21 12:57

Description

Failed to execute goal org.owasp:dependency-check-maven:5.3.0:check (check-dependencies-for-vulnerabilities) on project dependencies:

One or more dependencies were identified with vulnerabilities:

org.apache.sling.resourcemerger-1.4.0.jar: CVE-2015-2944

See the dependency-check report for more details.