This is an automated email from the ASF dual-hosted git repository. jleroux pushed a commit to branch release22.01 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release22.01 by this push: new c7b9b2ac14 Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts (OFBIZ-12766) c7b9b2ac14 is described below commit c7b9b2ac148045e15ff0226df5637b8d9a2551c1 Author: Jacques Le Roux <jacques.le.r...@les7arts.com> AuthorDate: Tue Feb 21 08:59:58 2023 +0100 Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts (OFBIZ-12766) See https://commons.apache.org/proper/commons-fileupload/security-reports.html https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71 for details Conflicts handled by hand --- build.gradle | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/build.gradle b/build.gradle index eac3d997f1..baad159d10 100644 --- a/build.gradle +++ b/build.gradle @@ -217,7 +217,7 @@ dependencies { implementation 'com.sun.mail:javax.mail:1.6.2' implementation 'com.rometools:rome:1.16.0' implementation 'com.thoughtworks.xstream:xstream:1.4.18' - implementation 'commons-fileupload:commons-fileupload:1.4' + implementation 'commons-fileupload:commons-fileupload:1.5' implementation 'commons-net:commons-net:3.8.0' implementation 'commons-validator:commons-validator:1.7' implementation 'de.odysseus.juel:juel-impl:2.2.7' @@ -243,8 +243,8 @@ dependencies { implementation 'org.apache.tika:tika-parsers:2.5.0' implementation 'org.apache.tika:tika-parser-pdf-module:2.5.0' implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:3.5.3' - implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.69' // Remember to change the version number (9 now) in javadoc block if needed. - implementation 'org.apache.tomcat:tomcat-jasper:9.0.69' + implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.71' // Remember to change the version number (9 now) in javadoc block if needed. + implementation 'org.apache.tomcat:tomcat-jasper:9.0.71' implementation 'org.apache.axis2:axis2-kernel:1.7.9' // Above: SOAPEventHandler.java:42: error: package org.apache.axiom.om.impl.builder does not exist implementation 'batik:batik-svg-dom:1.6-1' implementation 'org.apache.xmlgraphics:fop:2.3' // NOTE: since 2.4 dependencies are messed up. See https://github.com/moqui/moqui-fop/blob/master/build.gradle