Ksenia Hershkovici created MNG-7414:
---------------------------------------
Summary: Maven version 3.8.3 + 3.8.4 have jsoup vulnerability
Key: MNG-7414
URL: https://issues.apache.org/jira/browse/MNG-7414
Project: Maven
Issue Type: Bug
Reporter: Ksenia Hershkovici
Hi Team,
We are facing jsoup component vulnerability with maven versions 3.8.3 and 3.8.4
which is the latest released version of maven. The CVE details are:
CVE-2021-37714
Jsoup version which is getting installed while installing maven 3.8.3 and 3.8.4
is v1.12.1.
We noticed that both versions have wagon 3.4.3 that is probably installing
Jsoup v1.12.1.
Can you please provide the details of next maven version release with this fix
in it?
Thanks.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
