Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
None
-
None
Description
A simple upgrade of the jdom dependency does not work:
https://github.com/apache/creadur-whisker/pull/6
As Jdom is marked as a security problem of Whisker try updating and upgrading:
{{
CVE-2021-33813
high severity
Vulnerable versions: <= 2.0.6
Patched version: No fix
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. At this time there is not released fixed version of JDOM. As a workaround, to avoid external entities being expanded, one can call builder.setExpandEntities(false) and they won't be expanded.
}}
currently available version is:
<version>2.0.6.1</version>
https://github.com/hunterhacker/jdom
Attachments
Issue Links
- links to