Change 29210

paul_allen (Paul Allen)
Paul Allen committed this change into //guest/perforce_software/p4jenkins/main
Request Review
Download .zip
[SECURITY] Use HTTPS to resolve dependencies in Maven Build

vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
a31e790
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <team@moderne.io>
1 edited 0 added 0 deleted
Tip: Use n and p to cycle through the changes.