Skip to content

Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation #1437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
labkey-willm wants to merge 1 commit into from
+29 −7
Closed

Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation #1437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,8 @@ allprojects {
// force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
force "org.apache.httpcomponents:httpcore:${httpcoreVersion}"
force "org.apache.httpcomponents.core5:httpcore5:${httpcore5Version}"
// httpcore5-h2 arrives transitively (not pinned before); force to the fixed version for CVE-2026-54399
force "org.apache.httpcomponents.core5:httpcore5-h2:${httpcore5Version}"
// force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
force "org.apache.httpcomponents:httpclient:${httpclientVersion}"
force "org.apache.httpcomponents.client5:httpclient5:${httpclient5Version}"
Expand Down
20 changes: 20 additions & 0 deletions dependencyCheckSuppression.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,5 +437,25 @@
<packageUrl regex="true">^pkg:maven/com\.networknt/json-schema-validator@.*$</packageUrl>
<cve>CVE-2025-15104</cve>
</suppress>
<!--
CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
-->
<suppress>
<notes><![CDATA[
file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
<cve>CVE-2026-54399</cve>
</suppress>
<!--
CVE-2026-53914 is an unsafe-deserialization flaw in Kotlin build-cache metadata (build tooling); JetBrains (the CNA) scores it 6.7 MEDIUM (AV:L/AC:H/PR:H), not NVD's auto-assigned 9.8, and the advisory names no runtime package. The shipped Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, etc.) do not execute the affected code, and no stable fixed release exists yet (only 2.4.20-Beta1). False positive for the runtime artifacts.
-->
<suppress>
<notes><![CDATA[
Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, kotlin-stdlib-jdk7/jdk8) - build-tooling CVE, not applicable to runtime.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>

</suppressions>
14 changes: 7 additions & 7 deletions gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,8 @@ apacheDirectoryVersion=2.1.7
#Transitive dependency of Apache directory
apacheMinaVersion=2.2.7

# Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
apacheTomcatVersion=11.0.22
# Intentionally held ahead of the Tomcat version Spring Boot manages (SB 4.0.6 -> 11.0.21, 4.0.7 -> 11.0.22, both affected by CVE-2026-53434/-55276 et al.). Keep at 11.0.23+ until a Spring Boot release ships a patched Tomcat. (see springBootVersion below)
apacheTomcatVersion=11.0.23

# (mothership) -> json-path -> json-smart -> accessor-smart
# (core) -> graalvm
Expand Down Expand Up @@ -185,7 +185,7 @@ hamcrestVersion=2.2
htsjdkVersion=4.3.0

httpclient5Version=5.5.2
httpcore5Version=5.4.2
httpcore5Version=5.4.3

# Not used directly, but these are widely used transitive dependencies
httpclientVersion=4.5.14
Expand All @@ -194,9 +194,9 @@ httpcoreVersion=4.4.16
intellijKotlinVersion=2.3.10

# Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others
jacksonVersion=2.21.4
jacksonDatabindVersion=2.21.4
jacksonJaxrsBaseVersion=2.21.4
jacksonVersion=2.21.5
jacksonDatabindVersion=2.21.5
jacksonJaxrsBaseVersion=2.21.5

# Note the inconsistent version numbering for "annotations"... it no longer matches the above
jacksonAnnotationsVersion=2.21
Expand Down Expand Up @@ -300,7 +300,7 @@ slf4jLog4jApiVersion=2.0.18
# This is a dependency for HTSJDK. Force version for CVE-2023-43642
snappyJavaVersion=1.1.10.8

# Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version
# Note: apacheTomcatVersion above is intentionally held ahead of Spring Boot's managed Tomcat for CVE remediation (see the comment there)
springBootVersion=4.0.6
# This usually matches the Spring Framework version dictated by springBootVersion
springVersion=7.0.7
Expand Down