Skip to content
This repository was archived by the owner on Jun 2, 2025. It is now read-only.

Commit d09e3d4

Browse files
kenny-ezirimkenny-ezirim
committed
patch cves in sparkml docker container
1 parent 8bd60aa commit d09e3d4

File tree

2 files changed

+174
-11
lines changed

2 files changed

+174
-11
lines changed

‎Dockerfile

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,4 +59,27 @@ RUN cp ./serve.sh /usr/local/bin/serve.sh
5959

6060
RUN chmod a+x /usr/local/bin/serve.sh
6161

62+
# remove the maven-shared-utils packages - older versions create vulnerabilities
63+
RUN find / -depth -name maven-shared-utils -type d -exec rm -r "{}" \;
64+
65+
# remove the surefire packages - contains versions of maven-shared-utils that create vulnerabilities
66+
RUN find / -depth -name surefire -type d -exec rm -r "{}" \;
67+
68+
# remove maven-shared-utils jar file with vulnerabilities
69+
# comment out if need to use maven utilities
70+
RUN rm /usr/share/java/maven-shared-utils.jar
71+
72+
# remove plexus-utils directory because plexus-utils has vulnerabilities
73+
# comment out if need to use maven utilities
74+
RUN find / -depth -name plexus-utils -type d -exec rm -r "{}" \;
75+
76+
# remove old version of json-smart with vulnerability
77+
RUN find / -depth -name json-smart -type d -exec rm -r "{}/2.3" \;
78+
79+
# remove old version of commons-compress with vulnerability
80+
RUN find / -depth -name commons-compress -type d -exec rm -r "{}/1.18" \;
81+
82+
# remove old version of spring-core with vulnerability
83+
RUN find / -depth -name spring-core -type d -exec rm -r "{}/5.1.19.RELEASE" \;
84+
6285
ENTRYPOINT ["/usr/local/bin/serve.sh"]

‎pom.xml

Lines changed: 151 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -131,11 +131,6 @@
131131
</plugins>
132132
</build>
133133
<dependencies>
134-
<dependency>
135-
<groupId>com.google.guava</groupId>
136-
<artifactId>guava</artifactId>
137-
<version>[30.0-jre,)</version>
138-
</dependency>
139134
<dependency>
140135
<groupId>com.googlecode.netlib-java</groupId>
141136
<artifactId>netlib-java</artifactId>
@@ -230,20 +225,165 @@
230225
<artifactId>spring-boot-starter-json</artifactId>
231226
<version>2.7.5</version>
232227
</dependency>
228+
<dependency>
229+
<groupId>com.fasterxml.jackson.core</groupId>
230+
<artifactId>jackson-databind</artifactId>
231+
<version>2.14.0-rc2</version>
232+
</dependency>
233233
<dependency>
234234
<groupId>com.fasterxml.jackson.core</groupId>
235235
<artifactId>jackson-core</artifactId>
236-
<version>2.13.4</version>
236+
<version>2.14.0-rc2</version>
237237
</dependency>
238238
<dependency>
239239
<groupId>com.fasterxml.jackson.core</groupId>
240-
<artifactId>jackson-databind</artifactId>
241-
<version>2.13.4.2</version>
240+
<artifactId>jackson-annotations</artifactId>
241+
<version>2.14.0-rc2</version>
242+
</dependency>
243+
<dependency>
244+
<groupId>com.jayway.jsonpath</groupId>
245+
<artifactId>json-path</artifactId>
246+
<version>2.7.0</version>
247+
</dependency>
248+
<dependency>
249+
<groupId>org.springframework</groupId>
250+
<artifactId>spring-web</artifactId>
251+
<version>5.3.23</version>
252+
</dependency>
253+
<dependency>
254+
<groupId>org.springframework</groupId>
255+
<artifactId>spring-beans</artifactId>
256+
<version>5.3.23</version>
257+
</dependency>
258+
<dependency>
259+
<groupId>org.springframework</groupId>
260+
<artifactId>spring-webmvc</artifactId>
261+
<version>5.3.23</version>
262+
</dependency>
263+
<dependency>
264+
<groupId>org.springframework</groupId>
265+
<artifactId>spring-core</artifactId>
266+
<version>5.3.23</version>
267+
</dependency>
268+
<dependency>
269+
<groupId>org.springframework.boot</groupId>
270+
<artifactId>spring-boot-autoconfigure</artifactId>
271+
<version>2.7.5</version>
272+
</dependency>
273+
<dependency>
274+
<groupId>org.springframework</groupId>
275+
<artifactId>spring-context</artifactId>
276+
<version>5.3.23</version>
277+
</dependency>
278+
<dependency>
279+
<groupId>org.springframework</groupId>
280+
<artifactId>spring-expression</artifactId>
281+
<version>5.3.23</version>
282+
</dependency>
283+
<dependency>
284+
<groupId>org.springframework.boot</groupId>
285+
<artifactId>spring-boot</artifactId>
286+
<version>2.7.5</version>
287+
</dependency>
288+
<dependency>
289+
<groupId>org.springframework</groupId>
290+
<artifactId>spring-aop</artifactId>
291+
<version>5.3.23</version>
292+
</dependency>
293+
<dependency>
294+
<groupId>org.springframework</groupId>
295+
<artifactId>spring-jcl</artifactId>
296+
<version>5.3.23</version>
297+
</dependency>
298+
<dependency>
299+
<groupId>org.yaml</groupId>
300+
<artifactId>snakeyaml</artifactId>
301+
<version>1.33</version>
302+
</dependency>
303+
<dependency>
304+
<groupId>org.apache.commons</groupId>
305+
<artifactId>commons-compress</artifactId>
306+
<version>1.21</version>
307+
</dependency>
308+
<dependency>
309+
<groupId>com.google.protobuf</groupId>
310+
<artifactId>protobuf-java</artifactId>
311+
<version>4.0.0-rc-2</version>
312+
</dependency>
313+
<dependency>
314+
<groupId>com.google.guava</groupId>
315+
<artifactId>guava</artifactId>
316+
<version>31.1-jre</version>
317+
</dependency>
318+
<dependency>
319+
<groupId>org.eclipse.jetty</groupId>
320+
<artifactId>jetty-servlet</artifactId>
321+
<version>9.4.49.v20220914</version>
322+
</dependency>
323+
<dependency>
324+
<groupId>org.eclipse.jetty</groupId>
325+
<artifactId>jetty-webapp</artifactId>
326+
<version>9.4.49.v20220914</version>
327+
</dependency>
328+
<dependency>
329+
<groupId>org.eclipse.jetty</groupId>
330+
<artifactId>jetty-util</artifactId>
331+
<version>9.4.49.v20220914</version>
332+
</dependency>
333+
<dependency>
334+
<groupId>org.eclipse.jetty</groupId>
335+
<artifactId>jetty-http</artifactId>
336+
<version>9.4.49.v20220914</version>
337+
</dependency>
338+
<dependency>
339+
<groupId>org.eclipse.jetty</groupId>
340+
<artifactId>jetty-io</artifactId>
341+
<version>9.4.49.v20220914</version>
342+
</dependency>
343+
<dependency>
344+
<groupId>org.eclipse.jetty</groupId>
345+
<artifactId>jetty-servlets</artifactId>
346+
<version>9.4.49.v20220914</version>
347+
</dependency>
348+
<dependency>
349+
<groupId>org.eclipse.jetty</groupId>
350+
<artifactId>jetty-server</artifactId>
351+
<version>9.4.49.v20220914</version>
352+
</dependency>
353+
<dependency>
354+
<groupId>org.eclipse.jetty</groupId>
355+
<artifactId>jetty-client</artifactId>
356+
<version>9.4.49.v20220914</version>
357+
</dependency>
358+
<dependency>
359+
<groupId>org.eclipse.jetty.websocket</groupId>
360+
<artifactId>websocket-server</artifactId>
361+
<version>9.4.49.v20220914</version>
362+
</dependency>
363+
<dependency>
364+
<groupId>org.eclipse.jetty.websocket</groupId>
365+
<artifactId>javax-websocket-server-impl</artifactId>
366+
<version>9.4.49.v20220914</version>
367+
</dependency>
368+
<dependency>
369+
<groupId>org.eclipse.jetty.websocket</groupId>
370+
<artifactId>javax-websocket-client-impl</artifactId>
371+
<version>9.4.49.v20220914</version>
372+
</dependency>
373+
<dependency>
374+
<groupId>org.eclipse.jetty.websocket</groupId>
375+
<artifactId>websocket-common</artifactId>
376+
<version>9.4.49.v20220914</version>
377+
</dependency>
378+
<dependency>
379+
<groupId>commons-io</groupId>
380+
<artifactId>commons-io</artifactId>
381+
<version>2.11.0</version>
242382
</dependency>
243383
<dependency>
244-
<groupId>org.apache.maven.shared</groupId>
245-
<artifactId>maven-shared-utils</artifactId>
246-
<version>3.3.4</version>
384+
<groupId>org.jsoup</groupId>
385+
<artifactId>jsoup</artifactId>
386+
<version>1.15.3</version>
247387
</dependency>
248388
</dependencies>
249389
<properties>

0 commit comments

Comments
 (0)