upgrade apache commons libs due to cves
- Dominant language
- Java
- Stars
- 6.1k
- Forks
- 1.5k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 189
Description
commons-collections 3.2.1 has a well-known CVE - see https://mvnrepository.com/artifact/commons-collections/commons-collections
commons-io 2.4 cve -see https://mvnrepository.com/artifact/commons-io/commons-io
commons-beanutils 1.8.3 - see https://mvnrepository.com/artifact/commons-beanutils/commons-beanutils
commons-compress 1.20 cves - see https://mvnrepository.com/artifact/org.apache.commons/commons-compress
libthrift 0.12.0 cve = see https://mvnrepository.com/artifact/org.apache.thrift/libthrift
httclient 4.5.9 cve - see https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient
Contributor guide
Research direction
Locate the dependency declarations for commons-collections, commons-io, commons-beanutils, commons-compress, libthrift, and httpclient, then check their current versions against the referenced CVEs. Run the relevant project tests after upgrading them; done means the vulnerable versions are replaced without regressions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100