Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE in dependency #30

Open
mvarela opened this issue Sep 23, 2024 · 0 comments
Open

CVE in dependency #30

mvarela opened this issue Sep 23, 2024 · 0 comments

Comments

@mvarela
Copy link
Member

mvarela commented Sep 23, 2024

From https://clojurians.slack.com/archives/C059F2KE7PD/p1726834353289909:

Hey. We’ve been using metosion/ring-swagger-ui and recently we’ve got this CVE in our dependency scans https://nvd.nist.gov/vuln/detail/CVE-2024-45801. Turns out this vuln is present via swagger-ui, since 16.9.2024:
One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '5.0': 

****.standalone.jar: swagger-ui-bundle.js: CVE-2024-45801(10.0)
****.standalone.jar: swagger-ui-es-bundle.js: CVE-2024-45801(10.0)
I think that you’ll need to update to the latest swagger-ui for this one.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant