[SLING-11124] Remove Guava Dependency for CVE CVE-2018-10237 and CVE-2020-8908

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Apache Sling Testing Clients 3.0.10
• Fix Version/s: Apache Sling Testing Clients 3.0.10
• Component/s: Apache Sling Testing Clients
• Assignee: Andrei Dulvac
• Reporter: Andrei Tuicu
• Created: 04/Feb/22 15:25
• Updated: 31/Oct/24 10:59
• Resolved: 04/Feb/22 16:27

Description

Sling testing clients are using com.google.guava guava 14.0.1 which is vulnerable to CVE-2018-10237(MEDIUM) [1] and CVE-2020-8908(LOW) [2].

Mitigation: remove the guava dependency.

[1] https://www.cvedetails.com/cve/CVE-2018-10237/
[2] https://www.cvedetails.com/cve/CVE-2020-8908/