Those CVEs are in test dependencies. You should configure your scanner to
ignore those.
- Jonas
On Tue, May 27, 2025, 03:04 Kaiser Song <kaiser(a)alda.ai> wrote:
We are currently using version 2.3.18 of the library available at
https://mvnrepository.com/artifact/io.undertow/undertow-core/2.3.18.Final.
Given the stringent security requirements in the financial sector, using
versions with known vulnerabilities is not feasible for our organization.
However, version 2.3.18 contains vulnerabilities associated with
CVE-2022-45868 and CVE-2020-13956. It would be greatly appreciated if an
updated version that addresses these security vulnerabilities could be
published to Maven Repository.
_______________________________________________
undertow-dev mailing list -- undertow-dev(a)lists.jboss.org
To unsubscribe send an email to undertow-dev-leave(a)lists.jboss.org
Privacy Statement:
https://www.redhat.com/en/about/privacy-policy
List Archives:
https://lists.jboss.org/archives/list/undertow-dev@lists.jboss.org/messag...