From 7cd4e234c1bb8b0d2c2cdfe569e1c409d1f48371 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Sat, 16 Dec 2023 17:26:57 +0000 Subject: [PATCH] vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 This fixes a security vulnerability in this project where the `pom.xml` files were configuring Maven to resolve dependencies over HTTP instead of HTTPS. Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere Severity: High CVSS: 8.1 Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/8 Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/8 Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D Co-authored-by: Moderne --- impl/pom.xml | 2 +- java5tools/pom.xml | 2 +- lib/pom.xml | 2 +- pom.xml | 4 ++-- sdo-api/pom.xml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/impl/pom.xml b/impl/pom.xml index 736bcb6..cca065b 100644 --- a/impl/pom.xml +++ b/impl/pom.xml @@ -32,7 +32,7 @@ codehaus Codehaus maven repository - http://repository.codehaus.org/ + https://repository.codehaus.org/ diff --git a/java5tools/pom.xml b/java5tools/pom.xml index 57ad9f9..0b89de2 100644 --- a/java5tools/pom.xml +++ b/java5tools/pom.xml @@ -52,7 +52,7 @@ eclipse.emf - http://download.eclipse.org/tools/emf/maven2 + https://download.eclipse.org/tools/emf/maven2 true diff --git a/lib/pom.xml b/lib/pom.xml index 4089027..f697542 100644 --- a/lib/pom.xml +++ b/lib/pom.xml @@ -33,7 +33,7 @@ codehaus Codehaus maven repository - http://repository.codehaus.org/ + https://repository.codehaus.org/ diff --git a/pom.xml b/pom.xml index 372fe1b..19966fb 100644 --- a/pom.xml +++ b/pom.xml @@ -40,7 +40,7 @@ apache.snapshots Apache Snapshot Repository - http://people.apache.org/repo/m2-snapshot-repository + https://people.apache.org/repo/m2-snapshot-repository false @@ -56,7 +56,7 @@ http://ftp.osuosl.org/pub/eclipse/tools/emf/maven2 --> indiana - http://ftp.ussg.iu.edu/eclipse/modeling/emf/emf/maven2/ + https://ftp.ussg.iu.edu/eclipse/modeling/emf/emf/maven2/ true diff --git a/sdo-api/pom.xml b/sdo-api/pom.xml index 6d66d45..e071218 100644 --- a/sdo-api/pom.xml +++ b/sdo-api/pom.xml @@ -40,7 +40,7 @@ apache.snapshots Apache Snapshot Repository - http://people.apache.org/repo/m2-snapshot-repository + https://people.apache.org/repo/m2-snapshot-repository false