Skip to content

Commit 2e0c232

Browse files
DovOpsDovOps
authored
Update vulnerable java dependencies, and reset suppressions for java (#315)
1 parent 3c1f959 commit 2e0c232

File tree

6 files changed

+49
-227
lines changed

6 files changed

+49
-227
lines changed

‎.github/gradle-cve-ignore-list.xml‎

Lines changed: 9 additions & 148 deletions
Original file line numberDiff line numberDiff line change
@@ -1,151 +1,12 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress>
4-
<notes><![CDATA[Not using webAdminPassword startup parameter]]></notes>
5-
<filePath regex="true">.*\bh2-2\.3\.232\.jar</filePath>
6-
<cve>CVE-2022-45868</cve>
7-
</suppress>
8-
<suppress>
9-
<notes><![CDATA[Not running backups]]></notes>
10-
<filePath regex="true">.*\bh2-2\.3\.232\.jar</filePath>
11-
<cve>CVE-2018-14335</cve>
12-
</suppress>
13-
<suppress>
14-
<notes><![CDATA[Ignoring, since we don't unmarshal XML to JSON; see https://github.com/stleary/JSON-java/issues/708]]></notes>
15-
<filePath regex="true">.*\bjson-20231013\.jar</filePath>
16-
<cve>CVE-2022-45688</cve>
17-
</suppress>
18-
<suppress>
19-
<notes><![CDATA[BrotliInterceptor is not used, see https://nvd.nist.gov/vuln/detail/CVE-2023-3782]]></notes>
20-
<filePath regex="true">.*\bokhttp-4\.10\.0\.jar</filePath>
21-
<cve>CVE-2023-3782</cve>
22-
</suppress>
23-
<suppress>
24-
<notes><![CDATA[GzipSource class is not used, see https://nvd.nist.gov/vuln/detail/CVE-2023-3635]]></notes>
25-
<filePath regex="true">.*\bokio-jvm-3\.0\.0\.jar</filePath>
26-
<cve>CVE-2023-3635</cve>
27-
</suppress>
28-
29-
<!-- Logback CVE suppressions -->
30-
<suppress>
31-
<notes><![CDATA[LoggerContext configuration not exposed via JMX]]></notes>
32-
<filePath regex="true">.*\blogback-core-1\.4\.14\.jar</filePath>
33-
<cve>CVE-2024-12798</cve>
34-
</suppress>
35-
36-
<!-- Spring Framework CVE suppressions - waiting for newer version -->
37-
<suppress>
38-
<notes><![CDATA[No Spring security vulnerabilities in current usage pattern]]></notes>
39-
<filePath regex="true">.*\bspring-context-6\.1\.6\.jar</filePath>
40-
<cve>CVE-2024-38820</cve>
41-
</suppress>
42-
<suppress>
43-
<notes><![CDATA[No Spring security vulnerabilities in current usage pattern]]></notes>
44-
<filePath regex="true">.*\bspring-core-6\.1\.6\.jar</filePath>
45-
<cve>CVE-2024-38820</cve>
46-
</suppress>
47-
<suppress>
48-
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
49-
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
50-
<cve>CVE-2025-41234</cve>
51-
</suppress>
52-
<suppress>
53-
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
54-
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
55-
<cve>CVE-2024-38809</cve>
56-
</suppress>
57-
<suppress>
58-
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
59-
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
60-
<cve>CVE-2024-38820</cve>
61-
</suppress>
62-
<suppress>
63-
<notes><![CDATA[No Spring webmvc vulnerabilities in current usage pattern]]></notes>
64-
<filePath regex="true">.*\bspring-webmvc-6\.1\.6\.jar</filePath>
65-
<cve>CVE-2024-38816</cve>
66-
</suppress>
67-
<suppress>
68-
<notes><![CDATA[No Spring webmvc vulnerabilities in current usage pattern]]></notes>
69-
<filePath regex="true">.*\bspring-webmvc-6\.1\.6\.jar</filePath>
70-
<cve>CVE-2024-38820</cve>
71-
</suppress>
72-
73-
<!-- Swagger UI DOMPurify CVE suppressions -->
74-
<suppress>
75-
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
76-
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
77-
<cve>CVE-2024-45801</cve>
78-
</suppress>
79-
<suppress>
80-
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
81-
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
82-
<cve>CVE-2024-47875</cve>
83-
</suppress>
84-
<suppress>
85-
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
86-
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
87-
<cve>CVE-2025-26791</cve>
88-
</suppress>
89-
90-
<!-- Tomcat CVE suppressions -->
91-
<suppress>
92-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
93-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
94-
<cve>CVE-2025-49124</cve>
95-
</suppress>
96-
<suppress>
97-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
98-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
99-
<cve>CVE-2025-49125</cve>
100-
</suppress>
101-
<suppress>
102-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
103-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
104-
<cve>CVE-2024-38286</cve>
105-
</suppress>
106-
<suppress>
107-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
108-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
109-
<cve>CVE-2025-46701</cve>
110-
</suppress>
111-
<suppress>
112-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
113-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
114-
<cve>CVE-2025-48988</cve>
115-
</suppress>
116-
<suppress>
117-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
118-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
119-
<cve>CVE-2025-24813</cve>
120-
</suppress>
121-
<suppress>
122-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
123-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
124-
<cve>CVE-2025-31651</cve>
125-
</suppress>
126-
<suppress>
127-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
128-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
129-
<cve>CVE-2024-52316</cve>
130-
</suppress>
131-
<suppress>
132-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
133-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
134-
<cve>CVE-2024-34750</cve>
135-
</suppress>
136-
<suppress>
137-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
138-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
139-
<cve>CVE-2025-31650</cve>
140-
</suppress>
141-
<suppress>
142-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
143-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
144-
<cve>CVE-2024-54677</cve>
145-
</suppress>
146-
<suppress>
147-
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
148-
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
149-
<cve>CVE-2024-50379</cve>
150-
</suppress>
3+
<suppress>
4+
<notes><![CDATA[
5+
CVE-2022-41940 and CVE-2020-36048 are in engine.io-client, a transitive dependency of socket.io-client.
6+
These are ReDoS and information disclosure vulnerabilities. Suppressed as they may not be exploitable in this application's usage.
7+
]]></notes>
8+
<filePath regex="true">.*\bengine\.io-client.*\.jar</filePath>
9+
<cve>CVE-2022-41940</cve>
10+
<cve>CVE-2020-36048</cve>
11+
</suppress>
15112
</suppressions>

‎account-service/build.gradle‎

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.5.3'
10+
id 'org.springframework.boot' version '3.5.7'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -17,31 +17,21 @@ version = '0.0.1-SNAPSHOT'
1717
java {
1818
sourceCompatibility = JavaVersion.VERSION_21
1919
}
20-
configurations.all {
21-
resolutionStrategy.eachDependency { details ->
22-
if (details.requested.group == 'org.springframework' && details.requested.name == 'spring-core') {
23-
details.useVersion('6.2.11')
24-
details.because('CVE-2025-41249')
25-
} else if (details.requested.group == 'org.apache.tomcat.embed' && details.requested.name == 'tomcat-embed-core') {
26-
details.useVersion('10.1.44')
27-
details.because('CVE-2025-48989')
28-
}
29-
}
30-
}
3120

3221
dependencies {
3322

3423
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
3524
implementation 'org.springframework.boot:spring-boot-starter-web'
36-
implementation 'com.h2database:h2:2.3.232'
25+
implementation 'com.h2database:h2:2.4.240'
3726

38-
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
39-
40-
// Force logback versions to fix CVE-2024-12798
41-
implementation ('ch.qos.logback:logback-core:1.5.18') {
42-
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
27+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14') {
28+
exclude group: 'org.webjars', module: 'swagger-ui'
4329
}
44-
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
30+
implementation 'org.webjars:swagger-ui:5.30.2'
31+
32+
// Force logback versions to latest stable
33+
implementation 'ch.qos.logback:logback-core:1.5.21'
34+
implementation 'ch.qos.logback:logback-classic:1.5.21' // Ensure compatibility
4535

4636
// Override commons-lang3 to fix CVE-2025-48924
4737
implementation 'org.apache.commons:commons-lang3:3.18.0' // Latest version to fix CVE-2025-48924

‎database/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ plugins {
1212
}
1313

1414
dependencies {
15-
implementation 'com.h2database:h2:2.3.232'
15+
implementation 'com.h2database:h2:2.4.240'
1616
}
1717

1818
application {

‎position-service/build.gradle‎

Lines changed: 9 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.5.3'
10+
id 'org.springframework.boot' version '3.5.7'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -17,29 +17,20 @@ version = '0.0.1-SNAPSHOT'
1717
java {
1818
sourceCompatibility = JavaVersion.VERSION_21
1919
}
20-
configurations.all {
21-
resolutionStrategy.eachDependency { details ->
22-
if (details.requested.group == 'org.springframework' && details.requested.name == 'spring-core') {
23-
details.useVersion('6.2.11')
24-
details.because('CVE-2025-41249')
25-
} else if (details.requested.group == 'org.apache.tomcat.embed' && details.requested.name == 'tomcat-embed-core') {
26-
details.useVersion('10.1.44')
27-
details.because('CVE-2025-48989')
28-
}
29-
}
30-
}
3120

3221
dependencies {
3322

3423
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
3524
implementation 'org.springframework.boot:spring-boot-starter-web'
36-
implementation 'com.h2database:h2:2.3.232'
37-
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
38-
39-
implementation ('ch.qos.logback:logback-core:1.5.18') {
40-
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
25+
implementation 'com.h2database:h2:2.4.240'
26+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14') {
27+
exclude group: 'org.webjars', module: 'swagger-ui'
4128
}
42-
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
29+
implementation 'org.webjars:swagger-ui:5.30.2'
30+
31+
// Force logback versions to latest stable
32+
implementation 'ch.qos.logback:logback-core:1.5.21'
33+
implementation 'ch.qos.logback:logback-classic:1.5.21' // Ensure compatibility
4334

4435
// Override commons-lang3 to fix CVE-2025-48924
4536
implementation 'org.apache.commons:commons-lang3:3.18.0' // Latest version to fix CVE-2025-48924

‎trade-processor/build.gradle‎

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.5.3'
10+
id 'org.springframework.boot' version '3.5.7'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -17,41 +17,31 @@ version = '0.0.1-SNAPSHOT'
1717
java {
1818
sourceCompatibility = JavaVersion.VERSION_21
1919
}
20-
configurations.all {
21-
resolutionStrategy.eachDependency { details ->
22-
if (details.requested.group == 'org.springframework' && details.requested.name == 'spring-core') {
23-
details.useVersion('6.2.11')
24-
details.because('CVE-2025-41249')
25-
} else if (details.requested.group == 'org.apache.tomcat.embed' && details.requested.name == 'tomcat-embed-core') {
26-
details.useVersion('10.1.44')
27-
details.because('CVE-2025-48989')
28-
}
29-
}
30-
}
3120

3221
dependencies {
3322

3423
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
3524
implementation 'org.springframework.boot:spring-boot-starter-web'
36-
implementation 'com.h2database:h2:2.3.232'
25+
implementation 'com.h2database:h2:2.4.240'
3726

38-
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
27+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14') {
28+
exclude group: 'org.webjars', module: 'swagger-ui'
29+
}
30+
implementation 'org.webjars:swagger-ui:5.30.2'
3931

40-
implementation('org.json:json:20240303') {
32+
implementation('org.json:json:20250517') {
4133
because 'previous versions are affected by multiple CVE'
4234
}
4335
implementation ('io.socket:socket.io-client:2.1.2') {
4436
exclude group: 'org.json', module: 'json'
4537
}
4638

4739
// Override okhttp and okio versions to address vulnerabilities
48-
implementation 'com.squareup.okhttp3:okhttp:4.12.0' // Suggested version
40+
implementation 'com.squareup.okhttp3:okhttp:5.3.0' // Latest version
4941

5042
// Add compatible logback-classic version
51-
implementation ('ch.qos.logback:logback-core:1.5.18') {
52-
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
53-
}
54-
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
43+
implementation 'ch.qos.logback:logback-core:1.5.21'
44+
implementation 'ch.qos.logback:logback-classic:1.5.21' // Ensure compatibility
5545

5646
// Override commons-lang3 to fix CVE-2025-48924
5747
implementation 'org.apache.commons:commons-lang3:3.18.0' // Latest version to fix CVE-2025-48924

‎trade-service/build.gradle‎

Lines changed: 11 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.5.3'
10+
id 'org.springframework.boot' version '3.5.7'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -21,42 +21,32 @@ java {
2121
configurations.all {
2222
exclude group: 'org.yaml', module: 'snakeyaml'
2323
}
24-
configurations.all {
25-
resolutionStrategy.eachDependency { details ->
26-
if (details.requested.group == 'org.springframework' && details.requested.name == 'spring-core') {
27-
details.useVersion('6.2.11')
28-
details.because('CVE-2025-41249')
29-
} else if (details.requested.group == 'org.apache.tomcat.embed' && details.requested.name == 'tomcat-embed-core') {
30-
details.useVersion('10.1.44')
31-
details.because('CVE-2025-48989')
32-
}
33-
}
34-
}
3524

3625
dependencies {
3726

3827
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
3928
implementation 'org.springframework.boot:spring-boot-starter-web'
40-
implementation 'com.h2database:h2:2.3.232'
29+
implementation 'com.h2database:h2:2.4.240'
4130

42-
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
43-
44-
// Add compatible logback-classic version
45-
implementation ('ch.qos.logback:logback-core:1.5.18') {
46-
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
31+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14') {
32+
exclude group: 'org.webjars', module: 'swagger-ui'
4733
}
48-
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
34+
implementation 'org.webjars:swagger-ui:5.30.2'
35+
36+
// Force logback versions to latest stable
37+
implementation 'ch.qos.logback:logback-core:1.5.21'
38+
implementation 'ch.qos.logback:logback-classic:1.5.21' // Ensure compatibility
4939

5040
// JSON and Socket.IO dependencies
51-
implementation('org.json:json:20240303') {
41+
implementation('org.json:json:20250517') {
5242
because 'previous versions are affected by multiple CVE'
5343
}
5444
implementation ('io.socket:socket.io-client:2.1.2') {
5545
exclude group: 'org.json', module: 'json'
5646
}
5747

5848
// Override okhttp and okio versions to address vulnerabilities
59-
implementation 'com.squareup.okhttp3:okhttp:4.12.0' // Suggested version
49+
implementation 'com.squareup.okhttp3:okhttp:5.3.0' // Latest version
6050

6151
// Override commons-lang3 to fix CVE-2025-48924
6252
implementation 'org.apache.commons:commons-lang3:3.18.0' // Latest version to fix CVE-2025-48924

0 commit comments

Comments
 (0)