Sonarqube 正在抛出 undertow-core 漏洞发现。如何解决

Question

Sonarqube 正在抛出 undertow-core 漏洞发现。如何解决。

   "textRange": {
      "startLine": 1,
      "endLine": 1,
      "startOffset": 0,
      "endOffset": 38
    },
    "flows": [],
    "status": "OPEN",
    "message": "Filename: test-0.0.1-SNAPSHOT.jar: undertow-core-2.0.29.Final.jar 
| Reference: CVE-2020-1745 | CVSS Score: 9.8 | Category: CWE-200 | A file inclusion 
vulnerability was found 
in the AJP connector enabled with a default AJP configuration port of 8009 in 
Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, 
unauthenticated attacker could exploit this vulnerability to read web application files 
from a vulnerable server. In instances where the vulnerable server allows file uploads, 
an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file 
types and trigger this vulnerability to gain remote code execution.",

Undertow 在 pom 上不可用，因为它是另一个依赖项的子项（spring-boot-starter-undertow，已更新到最新版本 2.3。3.RELEASE ).有没有办法让 spring-boot-starter 有特定版本的 undertow？



[INFO] +- org.springframework.boot:spring-boot-starter-undertow:jar:2.3.3.RELEASE:compile
[INFO] |  +- io.undertow:undertow-core:jar:2.0.29.Final:compile
[INFO] |  |  +- org.jboss.xnio:xnio-api:jar:3.3.8.Final:compile
[INFO] |  |  \- org.jboss.xnio:xnio-nio:jar:3.3.8.Final:runtime

[INFO] |  +- io.undertow:undertow-servlet:jar:2.0.29.Final:compile
[INFO] |  +- io.undertow:undertow-websockets-jsr:jar:2.0.29.Final:compile
[INFO] |  |  \- org.jboss.spec.javax.websocket:jboss-websocket-api_1.1_spec:jar:1.1.4.Final:compile
[INFO] |  +- jakarta.servlet:jakarta.servlet-api:jar:4.0.3:compile
[INFO] |  \- org.glassfish:jakarta.el:jar:3.0.3:compile

Answer 1

如果您需要特定版本的 Undertow，只需将其添加到您的 pom.xml:

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.0.30.Final</version>
</dependency>

通过这样做，您将覆盖您可能通过其他依赖项获得的任何其他版本 — 包括 Spring 的。

如果您需要的版本已经包含在其他一些包的依赖项中，并且您更愿意 Spring 使用那个版本（而不是手动覆盖 pom 中的每个 Undertow 依赖项），您可以尝试 exclude 刚好是开场白提供的：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
    <version>2.3.3.RELEASE</version> <!-- already includes undertow 2.0.30 -->
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
  <version>2.3.3.RELEASE</version>
  <exclusions>
    <exclusion>
      <groupId>io.undertow</groupId>
      <artifactId>undertow-core</artifactId>
    </exclusion>
  </exclusions>
</dependency>

如果您执行上述操作，Spring 将选择 spring-boot-actuator 提供的 undertow-core 版本，而不是 spring-boot-starter-undertow 提供的版本。

Sonarqube 正在抛出 undertow-core 漏洞发现。如何解决

Sonarqube is throwing undertow-core vulnerability finding. How to resolve

java

security

spring

sonarqube