Skip to content

Remove Velocity to avoid CVE-2020-13936 #15

Closed

Description

@jimbethancourt

All versions of velocity older than version 2.3 have been found to be vulnerable to remote code execution attacks, as captured in CVE-2020-13936 and has a CVSS score of 8.8 (high). Although this plugin does not permit template uploads, all corporate Maven import tools will still identify and flag this plugin as a vulnerable library since it transitively depends on Velocity 1.7.

The only option at this point is to remove all use of Doxia Site Renderer and generate identical HTML output within the plugin since Doxia Site Renderer relies on Velocity 1.7

Activity

  1. added a commit that references this issue on Jul 5, 2021
  2. jimbethancourt commented on Jul 22, 2021

    @jimbethancourt
    CollaboratorAuthor

    Fixed in 0.2.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions