From 19e7f18097c0e4947483a2fb6e839f88c3e477f2 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:18:25 +0100 Subject: [PATCH 1/4] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 + .trivyignore | 5 +++++ pom.xml | 12 +++--------- testsuite/integration-arquillian/pom.xml | 2 +- testsuite/integration-arquillian/tests/pom.xml | 4 ++-- testsuite/integration-arquillian/util/pom.xml | 2 +- testsuite/model/pom.xml | 4 ++-- testsuite/utils/pom.xml | 8 ++++---- util/embedded-ldap/pom.xml | 4 ++-- 9 files changed, 21 insertions(+), 21 deletions(-) create mode 100644 .trivyignore diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index ce9d38e8dae6..f8a2d0e0cc12 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,6 +33,7 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + vulnType: os,library ignore-unfixed: true version: v0.57.1 timeout: 15m diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..a49a346c608b --- /dev/null +++ b/.trivyignore @@ -0,0 +1,5 @@ +.CVE-2015-7501 # commons-collections:commons-collections +CVE-2019-17571 # log4j:log4j +CVE-2022-23305 # log4j:log4j +CVE-2022-23307 # log4j:log4j +CVE-2024-52046 # org.apache.mina:mina-core \ No newline at end of file diff --git a/pom.xml b/pom.xml index d3cabd03cb9f..73e6b4b43d33 100644 --- a/pom.xml +++ b/pom.xml @@ -107,7 +107,6 @@ 2.0.0.Final 2.0.1.Final 2.0.0.Final - 1.2.17 2.25.1 6.2.12.Final ${resteasy.version} @@ -121,7 +120,7 @@ 2.3.3-b02 ${undertow-legacy.version} 2.2.24.Final - 2.3.2.Final + 2.3.5.Final 2.6.5.Final 1.9.0.Final 6.0.3 @@ -475,8 +474,8 @@ ${resteasy.version} - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j @@ -558,11 +557,6 @@ ${picketlink.version} test - - log4j - log4j - ${log4j.version} - org.apache.logging.log4j log4j-core diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml index a0a79227b947..2d60da22d2c8 100644 --- a/testsuite/integration-arquillian/pom.xml +++ b/testsuite/integration-arquillian/pom.xml @@ -44,7 +44,7 @@ 1.9.3.Final 10.0.0.Final - 3.2.1 + 3.2.2 4.28.1 4.28.0 3.0.0-alpha.8 diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml index 6e6b5c7d2488..af9fc508cbd9 100644 --- a/testsuite/integration-arquillian/tests/pom.xml +++ b/testsuite/integration-arquillian/tests/pom.xml @@ -1569,8 +1569,8 @@ --> - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/testsuite/integration-arquillian/util/pom.xml b/testsuite/integration-arquillian/util/pom.xml index 9ac80456946e..d20d8af4c495 100644 --- a/testsuite/integration-arquillian/util/pom.xml +++ b/testsuite/integration-arquillian/util/pom.xml @@ -85,7 +85,7 @@ org.apache.sshd sshd-core - 2.7.0 + 2.9.2 jakarta.servlet diff --git a/testsuite/model/pom.xml b/testsuite/model/pom.xml index eaf0d13616d6..0badf05ce671 100644 --- a/testsuite/model/pom.xml +++ b/testsuite/model/pom.xml @@ -45,8 +45,8 @@ test - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml index 7f76af7a155a..814834990fee 100755 --- a/testsuite/utils/pom.xml +++ b/testsuite/utils/pom.xml @@ -78,8 +78,8 @@ keycloak-account-ui - log4j - log4j + org.apache.logging.log4j + log4j-core compile @@ -105,8 +105,8 @@ resteasy-core - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/util/embedded-ldap/pom.xml b/util/embedded-ldap/pom.xml index 7e2e899c1f21..34130d7444f1 100644 --- a/util/embedded-ldap/pom.xml +++ b/util/embedded-ldap/pom.xml @@ -48,8 +48,8 @@ jboss-logging - log4j - log4j + org.apache.logging.log4j + log4j-core compile From d1638275ca17222178a3f116b33b1fbc49baa715 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:20:09 +0100 Subject: [PATCH 2/4] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .trivyignore | 2 +- testsuite/integration-arquillian/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.trivyignore b/.trivyignore index a49a346c608b..0b91cb9b0ece 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,4 +1,4 @@ -.CVE-2015-7501 # commons-collections:commons-collections +CVE-2015-7501 # commons-collections:commons-collections CVE-2019-17571 # log4j:log4j CVE-2022-23305 # log4j:log4j CVE-2022-23307 # log4j:log4j diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml index 2d60da22d2c8..a0a79227b947 100644 --- a/testsuite/integration-arquillian/pom.xml +++ b/testsuite/integration-arquillian/pom.xml @@ -44,7 +44,7 @@ 1.9.3.Final 10.0.0.Final - 3.2.2 + 3.2.1 4.28.1 4.28.0 3.0.0-alpha.8 From 54423ae1aa0ec137b808c4b819c8c66e0d11428b Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:22:30 +0100 Subject: [PATCH 3/4] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index f8a2d0e0cc12..e14ee8654671 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -35,7 +35,6 @@ jobs: severity: MEDIUM,CRITICAL,HIGH vulnType: os,library ignore-unfixed: true - version: v0.57.1 timeout: 15m env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db From 42218dc7fca5af3cdfb48b007eadfab103841ad7 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:24:39 +0100 Subject: [PATCH 4/4] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .trivyignore | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index 0b91cb9b0ece..8929857c9a0a 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,5 +1,35 @@ +CVE-2015-6420 # commons-collections:commons-collections CVE-2015-7501 # commons-collections:commons-collections CVE-2019-17571 # log4j:log4j +CVE-2020-11022 # jquery +CVE-2020-11023 # jquery +CVE-2020-15522 # org.bouncycastle:bcprov-jdk15on +CVE-2020-35510 # org.jboss.remoting:jboss-remoting +CVE-2021-4104 # log4j:log4j +CVE-2021-41973 # org.apache.mina:mina-core +CVE-2022-23302 # log4j:log4j CVE-2022-23305 # log4j:log4j CVE-2022-23307 # log4j:log4j -CVE-2024-52046 # org.apache.mina:mina-core \ No newline at end of file +CVE-2022-4065 # org.testng:testng +CVE-2023-1973 # io.undertow:undertow-core +CVE-2023-26464 # log4j:log4j +CVE-2023-33201 # org.bouncycastle:bcprov-jdk15on +CVE-2023-33202 # org.bouncycastle:bcprov-jdk15on +CVE-2023-4639 # io.undertow:undertow-core +CVE-2023-5685 # org.jboss.xnio:xnio-api +CVE-2024-1459 # io.undertow:undertow-core +CVE-2024-1635 # io.undertow:undertow-core +CVE-2024-29857 # org.bouncycastle:bcprov-jdk15on +CVE-2024-30171 # org.bouncycastle:bcprov-jdk15on +CVE-2024-3653 # io.undertow:undertow-core +CVE-2024-52046 # org.apache.mina:mina-core +CVE-2024-5971 # io.undertow:undertow-core +CVE-2024-6162 # io.undertow:undertow-core +CVE-2024-6485 # bootstrap +CVE-2024-7885 # io.undertow:undertow-core +CVE-2025-11965 # io.vertx:vertx-web +CVE-2025-1647 # bootstrap +CVE-2025-48924 # commons-lang:commons-lang +CVE-2025-5731 # org.infinispan:infinispan-cli-client +CVE-2025-59250 # com.microsoft.sqlserver:mssql-jdbc +CVE-2025-9784 # io.undertow:undertow-core \ No newline at end of file