Maven - Frogbot updates non-vulnerable direct packages that were found as a vulnerable indirect dependencies
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
Describe the bug
In Maven, when Frogbot identifies an indirectly included package with a vulnerable version, which is also defined as a non-vulnerable version in the direct package dependencies, it tries to update the direct package to resolve the vulnerability
Current behavior
As described
Reproduction steps
Define com.fasterxml.woodstox:woodstox-core:jar:6.4.0 as a direct dependency.
Define com.azure:azure-storage-blob.jar:12.19.0 as a direct dependency that brings com.fasterxml.woodstox:woodstox-core:jar:6.2.7 as a vulnerable indirect.
Expected behavior
Frogbot shouldn't attempt to fix the direct dependency.
JFrog Frogbot version
2.11.0
Package manager info
Maven
Git provider
GitHub
JFrog Frogbot configuration yaml file
No response
Operating system type and version
Any
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Maven dependency graph with direct woodstox-core 6.4.0 and azure-storage-blob 12.19.0 bringing vulnerable woodstox-core 6.2.7 indirectly. Inspect Frogbot's Maven vulnerability-fix handling; done when it does not attempt to update the already non-vulnerable direct dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100