yesamer commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4335224071
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260,
CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable
versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test,
json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all
artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path
(test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >=
9.11. -->
Review Comment:
@jaedonP In this context comments are not valuable, in general we add a
comment in case we are overriding transitive dependencies from a dep.
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260,
CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable
versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test,
json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all
artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path
(test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >=
9.11. -->
+ <dependency>
+ <groupId>org.ow2.asm</groupId>
+ <artifactId>asm</artifactId>
+ <version>${version.org.ow2.asm}</version>
+ </dependency>
Review Comment:
@jaedonP Can't we use a bom that groups all those dependencies instead?
##########
kie-parent/pom.xml:
##########
@@ -286,6 +286,8 @@
<version.org.mvel>2.5.4.Final</version.org.mvel>
<!-- Version of JMH -->
<version.org.openjdk.jmh>1.21</version.org.openjdk.jmh>
+ <!-- CVE-2026-110257..110263, CVE-2026-110591, CVE-2026-110270: baseline
version for OW2 ASM, enforced via dependencyManagement below. -->
Review Comment:
@jaedonP Same
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
