Skip to content

Fix transitive CVE vulnerabilities in dependency tree - AST-142710 #339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cx-anand-nandeshwar wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Fix transitive CVE vulnerabilities in dependency tree - AST-142710 #339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d7d9d68
- Fixed spring security vulnerability - AST-142710
cx-anand-nandeshwar Apr 7, 2026
5b45d39
Fix transitive CVE vulnerabilities in dependency tree - AST-142710
cx-anand-nandeshwar Apr 8, 2026
1cfebb3
Fix transitive CVE vulnerabilities in dependency tree - AST-142710
cx-anand-nandeshwar Apr 8, 2026
8943189
Merge remote-tracking branch 'origin/vulnerability/spring_security_AS…
cx-anand-nandeshwar Apr 8, 2026
990b031
Fix CI checkout failure caused by missing PERSONAL_ACCESS_TOKEN secret
cx-anand-nandeshwar Apr 14, 2026
f7e6cef
Fix jackson.version: 2.21.1 → 2.21.2 (2.21.1 was never published)
cx-anand-nandeshwar Apr 14, 2026
7271ce3
Fix jackson-annotations resolution failure in agent module - AST-142710
cx-anand-nandeshwar Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
- name: Checkout
uses: actions/checkout@v4.1.7
with:
token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
token: ${{ secrets.PERSONAL_ACCESS_TOKEN || github.token }}

@cx-anurag-dalke cx-anurag-dalke Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change this to ${{ secrets.GITHUB_TOKEN }}

lfs: true # Ensure LFS files are checked out

- name: Set up JDK 17
Expand Down
12 changes: 12 additions & 0 deletions checkmarx-ast-teamcity-plugin-agent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,12 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: exclude common-jackson so
agent-api cannot pull in jackson-core @ 2.19.0 (vulnerable). -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand All @@ -39,6 +45,12 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: exclude common-jackson to
keep the test classpath free of jackson-core @ 2.19.0. -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down
3 changes: 2 additions & 1 deletion checkmarx-ast-teamcity-plugin-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,11 @@
</exclusions>
</dependency>

<!-- Version governed by commons-lang3.version in root POM (CVE fix: 3.18.0) -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.18.0</version>
<version>${commons-lang3.version}</version>
</dependency>

<!-- Test Dependencies -->
Expand Down
37 changes: 37 additions & 0 deletions checkmarx-ast-teamcity-plugin-server/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,19 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- CVE-2026-22732: exclude EOL spring-security-oauth2 to prevent
its transitive pull of vulnerable spring-security-web < 6.5.9 -->
<exclusion>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: cut the
web-openapi -> common-jackson -> jackson-datatype-jdk8
-> jackson-core@2.19.0 transitive chain at source -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand All @@ -40,6 +53,19 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- CVE-2026-22732: exclude EOL spring-security-oauth2 to prevent
its transitive pull of vulnerable spring-security-web < 6.5.9
via web-openapi -> common-spring-security -> spring-security-oauth2 -->
<exclusion>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: server-web-api also carries
the web-openapi -> common-jackson chain; cut it here too -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand All @@ -52,6 +78,17 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- CVE-2026-22732: exclude EOL spring-security-oauth2 -->
<exclusion>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: tests-support also carries
common-jackson transitively; exclude to keep test classpath clean -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down
70 changes: 68 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,18 @@
<project.build.resourceEncoding>UTF-8</project.build.resourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<springFramework.version>6.2.11</springFramework.version>
<springSecurity.version>6.3.5</springSecurity.version>
<springSecurity.version>6.5.9</springSecurity.version>
<!-- CVE commons-lang3 uncontrolled recursion: ClassUtils.getClass() can throw
StackOverflowError on crafted long inputs → DoS.
Affected : commons-lang3 3.0 – 3.17.0 (and commons-lang 2.0 – 2.6)
Fix : 3.18.0+. Upgraded to 3.20.0 to stay in sync with
commons-text 1.15.0 which natively declares commons-lang3 @ 3.20.0,
eliminating the vulnerable declared-dependency path entirely. -->
<commons-lang3.version>3.20.0</commons-lang3.version>
<!-- commons-text 1.13.1 declared commons-lang3 @ 3.17.0 (vulnerable).
Upgrading to 1.15.0 which natively declares commons-lang3 @ 3.20.0,
removing the vulnerable transitive path from the artifact's own POM. -->
<commons-text.version>1.15.0</commons-text.version>
</properties>

<modules>
Expand Down Expand Up @@ -88,6 +99,19 @@
<groupId>commons-lang</groupId>
<artifactId>commons-lang</artifactId>
</exclusion>
<!-- CVE-2026-22732: exclude EOL spring-security-oauth2 to prevent
its transitive pull of vulnerable spring-security-web < 6.5.9 -->
<exclusion>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: exclude common-jackson bundle
to prevent jackson-core @ 2.19.0 (vulnerable) from entering
the test classpath transitively. -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down Expand Up @@ -135,6 +159,20 @@
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
</exclusion>
<!-- CVE-2026-22732 mitigation: springSecurity.version is now 6.5.9.
Keep excluding EOL spring-security-oauth2 to avoid its legacy
transitive chain and prevent vulnerable spring-security-web pull-ins. -->
<exclusion>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: exclude the TeamCity-internal
common-jackson bundle so that web-openapi cannot bring in
jackson-datatype-jdk8 → jackson-core @ 2.19.0 (vulnerable). -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down Expand Up @@ -180,6 +218,12 @@
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</exclusion>
<!-- jackson-core async-parser DoS: exclude common-jackson so
agent-api cannot pull in jackson-core @ 2.19.0 (vulnerable). -->
<exclusion>
<groupId>org.jetbrains.teamcity</groupId>
<artifactId>common-jackson</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down Expand Up @@ -312,12 +356,34 @@
<artifactId>gson</artifactId>
<version>2.12.0</version>
</dependency>
<dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.25.3</version>
<scope>provided</scope>
</dependency>

<!-- ===== commons-text + commons-lang3 version override =====
CVE: ClassUtils.getClass() uncontrolled recursion → StackOverflowError → DoS.
Root cause : commons-lang3 3.0 – 3.17.0.
commons-text 1.13.1 (transitive via TeamCity server-api) declared
commons-lang3 @ 3.17.0 in its own POM — scanners walking the declared
graph flagged the path even after the resolved version was overridden.
Fix : upgrade commons-text to 1.15.0, which natively declares
commons-lang3 @ 3.20.0, removing the vulnerable path from the
artifact's own metadata. commons-lang3 is also pinned independently
so no other path can re-introduce an older version. -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>${commons-text.version}</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>${commons-lang3.version}</version>
</dependency>

</dependencies>
</dependencyManagement>

Expand Down
Loading