Skip to content

Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation #1438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
labkey-willm wants to merge 1 commit into
base: develop
Choose a base branch
from
+25 −6
Open

Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation #1438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion dependencyCheckSuppression.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,5 +437,24 @@
<packageUrl regex="true">^pkg:maven/com\.networknt/json-schema-validator@.*$</packageUrl>
<cve>CVE-2025-15104</cve>
</suppress>

<!--
CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
-->
<suppress>
<notes><![CDATA[
file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
<cve>CVE-2026-54399</cve>
</suppress>
<!--
CVE-2026-53914 is an unsafe-deserialization flaw in Kotlin build-cache metadata (build tooling); JetBrains (the CNA) scores it 6.7 MEDIUM (AV:L/AC:H/PR:H), not NVD's auto-assigned 9.8, and the advisory names no runtime package. The shipped Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, etc.) do not execute the affected code, and no stable fixed release exists yet (only 2.4.20-Beta1). False positive for the runtime artifacts.
-->
<suppress>
<notes><![CDATA[
Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, kotlin-stdlib-jdk7/jdk8) - build-tooling CVE, not applicable to runtime.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>
</suppressions>
10 changes: 5 additions & 5 deletions gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ apacheDirectoryVersion=2.1.7
apacheMinaVersion=2.2.7

# Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
apacheTomcatVersion=11.0.22
apacheTomcatVersion=11.0.23

# (mothership) -> json-path -> json-smart -> accessor-smart
# (core) -> graalvm
Expand Down Expand Up @@ -185,7 +185,7 @@ hamcrestVersion=2.2
htsjdkVersion=4.3.0

httpclient5Version=5.5.2
httpcore5Version=5.4.2
httpcore5Version=5.4.3

# Not used directly, but these are widely used transitive dependencies
httpclientVersion=4.5.14
Expand All @@ -194,9 +194,9 @@ httpcoreVersion=4.4.16
intellijKotlinVersion=2.3.10

# Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others
jacksonVersion=2.21.4
jacksonDatabindVersion=2.21.4
jacksonJaxrsBaseVersion=2.21.4
jacksonVersion=2.21.5
jacksonDatabindVersion=2.21.5
jacksonJaxrsBaseVersion=2.21.5

# Note the inconsistent version numbering for "annotations"... it no longer matches the above
jacksonAnnotationsVersion=2.21
Expand Down