Upstream
/
ChestShop-3
mirror of https://github.com/ChestShop-authors/ChestShop-3.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 

This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/8

Co-authored-by: Moderne <team@moderne.io>
This commit is contained in:
Jonathan Leitschuh 2022-07-14 22:41:37 +00:00
parent fd0035a99c
commit 5066a21a5f
No known key found for this signature in database
GPG Key ID: CF90EC62F65468A1
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pom.xml
View File

@ -19,7 +19,7 @@
<repositories>
<repository>
<id>sk89q-repo</id>
<url>http://maven.sk89q.com/repo/</url>
<url>https://maven.sk89q.com/repo/</url>
</repository>
<repository>
<id>codemc-repo</id>
@ -31,7 +31,7 @@
</repository>
<repository>
<id>vault-repo</id>
<url>http://nexus.hc.to/content/repositories/pub_releases/</url>
<url>https://nexus.hc.to/content/repositories/pub_releases/</url>
</repository>
<repository>
<id>minebench-repo</id>