Reported Vulnerabilities with Gradle Workspace Plugin
written-by
Emma Carr-Gardner
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
legacy-article
learn-legacy-article-disclaimer-text
Issue
- We've been made aware of a vulnerability:
Environment
- Liferay Workspace (gradle v10.1.3)
Resolution
-
Jackson Dataformat YAML Dependency:
- The Liferay Workspace uses
jackson-dataformat-yaml for parsing YAML files. While this library has a vulnerable version of snakeyaml (1.27), it is upgraded at runtime to version 2.2, which is secure.
- To ensure consistency, the product team is updating the dependency to
jackson-dataformat-yaml 2.16.1, which includes snakeyaml 2.2. This update is currently in progress (ticket LPD-31541).
biz.aQute.bndlib Dependency:
- The
biz.aQute.bndlib library is a third-party library, and we do not control its versions or dependencies.
- As the vulnerable version of
snakeyaml included in biz.aQute.bndlib is not utilized within the Liferay Workspace, therefore, there are no plans to fix or update this library at this time.
- If you'd like, you may continue to exclude this library as you have done using the
exclude parameter in your settings.gradle.
did-this-article-resolve-your-issue