[SLING-9928] Sling el-api embeds vulnerable version of el-api

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Scripting EL API Wrapper 1.0.4
• Component/s: Scripting
• Assignee: Carsten Ziegeler
• Reporter: Akanksha Jain
• Created: 24/Nov/20 06:14
• Updated: 27/Nov/20 08:09
• Resolved: 24/Nov/20 07:37

Description

Issue summary : Security issues reported under org.apache.tomcat

Vulnerabilities

CVE-2014-7810 5.0 org.apache.tomcat : el-api : 6.0.14
https://nvd.nist.gov/vuln/detail/CVE-2014-7810

el-api-6.0.14 is embedded by org.apache.sling.scripting.el-api.

Expected: Need to update el-api version in org.apache.sling.scripting.el-api.