The security scan is telling me to upgrade to v 3.0 and it doesn’t exist everything is marked as vulnerable. I dont know what this package is… is it necessary? can I remove it?
https://mvnrepository.com/artifact/net.sourceforge.htmlunit/htmlunit
CVE-2023-26119 Critical net.sourceforge.htmlunit:htmlunit 2.60.0 java Not Supported Sysdig Secure v3.0.0 TRUE FALSE FALSE CVE-2023-26119 Critical net.sourceforge.htmlunit:htmlunit 2.60.0 java Not Supported Sysdig Secure v3.0.0 TRUE FALSE FALSE
cant run my builds now
its in different packages
https://mvnrepository.com/artifact/net.sourceforge.htmlunit/htmlunit/2.70.0
https://mvnrepository.com/artifact/org.htmlunit/htmlunit/3.0.0
can I please have my application online?
Hi,
I don’t see htmlunit library among Jmix dependencies. Could you please execute the gradlew dependencies command and see where it comes from?
Shows up as a GWT dependency and what I understand google has already abandoned that.
those htmlunit developers changed the package so updating to version 3 does nothing. scan still fails
spring 5x is dead
GWT is dead
my security scans are failing all over the place
I can’t get this application ONLINE for over week.
| Vulnerability | Severity | Package | Package Version | Package Type | Package Path | URL | Fix | Stop | Grace Period | Exception |
|---|---|---|---|---|---|---|---|---|---|---|
| CVE-2016-1000027 | Critical | org.springframework:spring-web | 5.3.29 | java | Not Supported | Sysdig Secure | v6.0.0 | TRUE | FALSE | TRUE |
| CVE-2016-1000027 | Critical | org.springframework:spring-web | 5.3.31.1 | java | Not Supported | Sysdig Secure | v6.0.0 | TRUE | FALSE | TRUE |
| CVE-2023-26119 | Critical | net.sourceforge.htmlunit:htmlunit | 2.60.0 | java | Not Supported | Sysdig Secure | v3.0.0 | TRUE | FALSE | FALSE |
| CVE-2022-29546 | High | net.sourceforge.htmlunit:htmlunit | 2.60.0 | java | Not Supported | Sysdig Secure | v2.61.0 | TRUE | FALSE | FALSE |
| CVE-2022-29546 | High | net.sourceforge.htmlunit:neko-htmlunit | 2.60.0 | java | Not Supported | Sysdig Secure | v2.61.0 | TRUE | FALSE | FALSE |
| CVE-2023-2798 | High | net.sourceforge.htmlunit:htmlunit | 2.60.0 | java | Not Supported | Sysdig Secure | v2.70.0 | TRUE | FALSE | FALSE |
fixed by adding to the build.gradle
configurations.all {
exclude group: “net.sourceforge.htmlunit”, module: “htmlunit”
}