Re: [cas-user] How to replace a certain java library version with another?

[Otto Myyrä]

Thanks jm and Sven.

You managed to direct me to the correct direction.

There was actually a ready-made commented-out line in build.gradle under
the bootWar declaration that excludes jars from the war without ruining the
build process:

cas {
from
"org.apereo.cas:cas-server-webapp${project.appServer}:${casServerVersion}@war
"
provided = false
//excludes = ["WEB-INF/lib/somejar-1.0*"]
}

Uncommented the line and replaced the somejar with common-text-1.8* and the
war was built without the old version.

BR,
Otto Myyrä

On Wed, Oct 19, 2022 at 1:06 PM Sven Specker 
wrote:

> Hi!
>
> You can search the archive of cas-user for the "log4j mitigation" of 2021.
>
> There is a comprehensive example how to replace that. Just adjust it for
> commons-text.
>
> Best regards,
>
> Sven Specker
>
> --
> __
> *** Sven Specker -- University of Frankfurt Computing Center   ***
> *** UNIX System Administration (Auth/IDM) 
> * spec...@rz.uni-frankfurt.de [Phone (+49)-69-798-15188] *
> **
> __
>
> Johann Wolfgang Goethe Universitaet
>- Hochschulrechenzentrum -
>  Theodor W. Adorno-Platz 1 (PA-1P16)
>
>D-60323 Frankfurt/Main
> __
> __ TeX-users do it in {groups}
>

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAAbxnYrPiKFfR6ye_XmTDbTX6CRkzk60dYXpBORSzHWKRFtzzg%40mail.gmail.com.

[cas-user] How to replace a certain java library version with another?

[Otto Myyrä]

Hi.

Due to a recent problem with apache-commons-text (CVE-2022-42889) we were
trying to replace the commons-text-1.8 java library in our cas 6.1
deployment. I can get the non-vulnerable 1.10 version to be included in the
build with an implementation clause in build.gradle, but the build still
insists on copying also the vulnerable 1.8 version into the resulting war
file.

If I use the exclude group functionality to prevent the 1.8 from being
used, then the build fails because it can't find the 1.8 version.

How can I get the commons-text-1.10 to replace the commons-text-1.8 so that
the 1.8 is not included in the built war file? Or is this even practical
and I should be trying some completely different approach?

BR,
Otto Myyrä

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAAbxnYqOxnh%3D4Q7CPqnqjNA9yBCxRpZy3%3D2HPXEzHxSULr2V2A%40mail.gmail.com.