From 610e820fc85c424042d5301fc558e2fdd04dda9b Mon Sep 17 00:00:00 2001
From: Timothy Lobl <lobtimo@amazon.com>
Date: Thu, 21 Nov 2024 14:42:33 +0000
Subject: [PATCH] Resolve CVE in aws pom
---
NOTICE | 10 +++++-----
provider/schema-aws/pom.xml | 12 +++++++++++-
2 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/NOTICE b/NOTICE
index d73fa7540..ca4aae89a 100644
--- a/NOTICE
+++ b/NOTICE
@@ -53,7 +53,7 @@ The following software have components provided under the terms of this license:
- Apache HttpCore (from http://hc.apache.org/httpcomponents-core-ga, http://hc.apache.org/httpcomponents-core-ga/, http://hc.apache.org/httpcomponents-core/)
- Apache Log4j API (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api)
- Apache Log4j Core (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core)
-- Apache Log4j JUL Adapter (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-jul)
+- Apache Log4j JUL Handler (from https://logging.apache.org/log4j/3.x/)
- Apache Log4j SLF4J Binding (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-slf4j-impl)
- Apache Log4j to SLF4J Adapter (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-to-slf4j)
- AssertJ Core (from https://assertj.github.io/doc/#assertj-core)
@@ -178,7 +178,7 @@ The following software have components provided under the terms of this license:
- Protocol Buffer extensions to the Google HTTP Client Library for Java. (from https://repo1.maven.org/maven2/com/google/http-client/google-http-client-protobuf)
- Proton-J (from https://repo1.maven.org/maven2/org/apache/qpid/proton-j)
- QpidJMS Client (from https://repo1.maven.org/maven2/org/apache/qpid/qpid-jms-client)
-- Redisson (from http://redisson.org)
+- Redisson (from http://redisson.org, https://redisson.pro)
- Retrofit (from https://github.com/square/retrofit, https://repo1.maven.org/maven2/com/squareup/retrofit2/retrofit)
- RxJava (from https://github.com/ReactiveX/RxJava)
- SnakeYAML (from http://code.google.com/p/snakeyaml/, http://www.snakeyaml.org, https://bitbucket.org/snakeyaml/snakeyaml)
@@ -327,7 +327,7 @@ The following software have components provided under the terms of this license:
- Protocol Buffer Java API (from http://code.google.com/p/protobuf, https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java)
- Protocol Buffers [Util] (from https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util)
- RE2/J (from http://github.com/google/re2j)
-- Redisson (from http://redisson.org)
+- Redisson (from http://redisson.org, https://redisson.pro)
- ReflectASM (from https://github.com/EsotericSoftware/reflectasm)
- Spring Core (from http://www.springframework.org, https://github.com/spring-projects/spring-framework, https://repo1.maven.org/maven2/org/springframework/spring-core)
- ThreeTen backport (from https://github.com/ThreeTen/threetenbp, https://www.threeten.org/threetenbp)
@@ -358,7 +358,7 @@ The following software have components provided under the terms of this license:
- Hibernate Validator (from https://hibernate.org/validator, https://repo1.maven.org/maven2/org/hibernate/hibernate-validator, https://repo1.maven.org/maven2/org/hibernate/validator/hibernate-validator)
- LatencyUtils (from http://latencyutils.github.io/LatencyUtils/)
- Netty/Common (from https://repo1.maven.org/maven2/io/netty/netty-common)
-- Redisson (from http://redisson.org)
+- Redisson (from http://redisson.org, https://redisson.pro)
- reactive-streams (from http://www.reactive-streams.org/)
========================================================================
@@ -547,7 +547,7 @@ The following software have components provided under the terms of this license:
- Netty/Codec/HTTP (from https://repo1.maven.org/maven2/io/netty/netty-codec-http)
- Netty/Common (from https://repo1.maven.org/maven2/io/netty/netty-common)
- Project Lombok (from http://projectlombok.org, https://projectlombok.org)
-- PyJWT (from http://github.com/jpadilla/pyjwt, https://github.com/jpadilla/pyjwt)
+- PyJWT (from http://github.com/jpadilla/pyjwt, https://pypi.org/project/PyJWT/)
- SLF4J API Module (from http://www.slf4j.org)
- Spring Cloud Azure AutoConfigure (from https://microsoft.github.io/spring-cloud-azure)
- Spring Cloud Azure Core (from https://microsoft.github.io/spring-cloud-azure)
diff --git a/provider/schema-aws/pom.xml b/provider/schema-aws/pom.xml
index 68959a969..e461acec6 100644
--- a/provider/schema-aws/pom.xml
+++ b/provider/schema-aws/pom.xml
@@ -62,7 +62,7 @@
<dependency>
<groupId>org.opengroup.osdu.core.aws</groupId>
<artifactId>os-core-lib-aws</artifactId>
- <version>3.0.1</version>
+ <version>3.0.2</version>
</dependency>
<dependency>
@@ -75,6 +75,16 @@
<artifactId>snakeyaml</artifactId>
<version>2.0</version>
</dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-common</artifactId>
+ <version>4.1.115.Final</version>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework.security</groupId>
+ <artifactId>spring-security-web</artifactId>
+ <version>6.3.4</version>
+ </dependency>
<dependency>
<groupId>jakarta.json</groupId>
<artifactId>jakarta.json-api</artifactId>
--
GitLab