reginaldalfret opened a new pull request, #4410: URL: https://github.com/apache/hertzbeat/pull/4410
### Summary Pin `xerces:xercesImpl` to 2.12.2 in root `pom.xml` dependency management to resolve CVE-2022-23437. ### Problem The distribution bundles `xercesImpl-2.11.0.jar` which is affected by [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) — an infinite loop / DoS vulnerability when parsing crafted XML, fixed in 2.12.2. ### Root Cause `xercesImpl` 2.11.0 is pulled in transitively via `easypoi-base` 4.3.0 and `nekohtml` 1.9.22. HertzBeat does not declare it directly. ### Fix 1. Added `<xerces.version>2.12.2</xerces.version>` property in root `pom.xml` 2. Added `xerces:xercesImpl` managed dependency in `<dependencyManagement>` 3. Updated `material/licenses/LICENSE` and `material/licenses/backend/LICENSE` to reflect version 2.12.2 ### Testing - Verified Maven dependency resolution pins xercesImpl to 2.12.2 - License files updated to match new version ### Issue Fixes #4408 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
