java icon indicating copy to clipboard operation
java copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-client

"Adal4j" library is not optional in 21.0.0.-legacy release

Open Babak-abd opened this issue 1 year ago • 3 comments
trafficstars

Describe the bug On https://github.com/kubernetes-client/java/pull/3175 PR, Adal was marked as Optional but when i am looking at 21.0.0-legacy on mvn repository, it does not show it as optional. I am sure that at one point, I saw it optional and our security scans did not report this.

now with this version, our scans are showing CVE-2021-31684 and CVE-2023-1370 which is related to nimbus-jose-jwt-9.8.1.jar and json-smart-2.4.2.jar libraries. Client Version 21.0.0.-legacy

Babak-abd avatar Jul 25 '24 15:07 Babak-abd