soulgalore
Study on OSS maven library vulnerabilities: httpcomponents library
Dear Github OSS Developer,
My name is Raula Kula, a research assistant prof at Osaka University, Japan. Currently I am studying the maintenance of Maven Libraries. I am currently focused on OSS vulnerabilities and the varying reasons for library migration.
As a part of my study I particularity focused on the commons-httpcomponents library. https://hc.apache.org/and the CVE-2012-6153 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153, announced on 11/04/2012 and revisited 09/04/2014, which affects versions up to 4.2.2
We noticed that your project on Github is still configured to depend on a vulnerable version of httpclients at {https://github.com/sitespeedio/crawler/blob/master/pom.xml}
We understand that there are many reasons for not migrating, thus we be appreciate if you could simply detail the following:
- Were you aware of the vulnerability? If so, then how long ago.
- What are some factors that influence you not to update.
- Does you project employ a update strategy, to check and update versions of currently used libraries?
Also feel free to detail any other information to help us understand your decision. Again, thank you for taking your time off your busy schedule and hope to hear from you soon. Please note that we respect your confidentiality, so we will not disclose any personal details in the study.
Sincerely, Raula Kula
