java-bean-validation-extension icon indicating copy to clipboard operation
java-bean-validation-extension copied to clipboard

Published 20 hours ago • verified publisher icon nomemory

CVE-2019-10086. Bump commons-beanutils version to 1.9.4

Open lcg936 opened this issue 5 years ago • 0 comments

Hi,

First of all thank you for all the work and effort put on this project, much appreciated.

The package commons-beanutils version 1.9.2 has been tagged with CVE-2019-10086. I leave you some references: https://nvd.nist.gov/vuln/detail/CVE-2019-10086 https://snyk.io/vuln/SNYK-JAVA-COMMONSBEANUTILS-460111

This is a transitive dependency from commons-validator, and there is no date for fix release from the Apache team.

Could you consider setting the commons-beanutils version to 1.9.4 as this version fixes the vulnerability?

Thanks in advance, Regards.

lcg936 avatar Dec 09 '19 11:12 lcg936