fix: Fix some CVEs (#1788)

GIScience · May 13, 2024 · dd4d4d8 · dd4d4d8
2 parents 748d625 + 80c59c0
commit dd4d4d8
Show file tree

Hide file tree

Showing 6 changed files with 26 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -43,6 +43,9 @@ RELEASING:
 - preparation mode exiting with code 0 on fail ([#1772](https://github.com/GIScience/openrouteservice/pull/1772))
 - some more properties can be defined in a user's ors-config.yml/env ors.engine.profile_default without side effects (Issue [#1762](https://github.com/GIScience/openrouteservice/issues/1762))
 
+### Security
+- Fix CVEs GHSA-hgjh-9rj2-g67j, GHSA-ccgv-vj62-xf9h, GHSA-7w75-32cg-r6g2, GHSA-v682-8vv8-vpwr ([#1788](https://github.com/GIScience/openrouteservice/pull/1788))
+
 ## [8.0.0] - 2024-03-21
 ### Added
 - snapping service endpoints for returning nearest points on the graph ([#1519](https://github.com/GIScience/openrouteservice/issues/1519))

diff --git a/Dockerfile b/Dockerfile
@@ -23,7 +23,7 @@ RUN sed -i "/ors.engine.source_file=.*/s/.*/ors.engine.source_file=\/home\/ors\/
         sed -i "/    source_file:.*/s/.*/    source_file: \/home\/ors\/files\/example-heidelberg.osm.gz/" "/tmp/ors/example-ors-config.yml"
 
 # build final image, just copying stuff inside
-FROM docker.io/amazoncorretto:21.0.2-alpine3.19 AS publish
+FROM docker.io/amazoncorretto:21.0.3-alpine3.19 AS publish
 
 # Build ARGS
 ARG UID=1000
@@ -35,7 +35,7 @@ ARG ORS_HOME=/home/ors
 ENV LANG='en_US' LANGUAGE='en_US' LC_ALL='en_US'
 
 # Setup the target system with the right user and folders.
-RUN apk update && apk add --no-cache bash yq jq && \
+RUN apk update && apk add --no-cache openssl bash yq jq  && \
     addgroup ors -g ${GID} && \
     mkdir -p ${ORS_HOME}/logs ${ORS_HOME}/files ${ORS_HOME}/graphs ${ORS_HOME}/elevation_cache  && \
     adduser -D -h ${ORS_HOME} -u ${UID} --system -G ors ors  && \

diff --git a/ors-api/pom.xml b/ors-api/pom.xml
@@ -133,6 +133,12 @@
         <dependency>
             <groupId>com.googlecode.json-simple</groupId>
             <artifactId>json-simple</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <!-- TODO: remove this if nothing breaks

diff --git a/ors-engine/pom.xml b/ors-engine/pom.xml
@@ -72,6 +72,12 @@
         <dependency>
             <groupId>com.googlecode.json-simple</groupId>
             <artifactId>json-simple</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <!-- TODO: remove this if nothing breaks

diff --git a/ors-report-aggregation/pom.xml b/ors-report-aggregation/pom.xml
@@ -18,6 +18,12 @@
             <groupId>org.heigit.ors</groupId>
             <artifactId>ors-engine</artifactId>
             <version>${project.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.heigit.ors</groupId>

diff --git a/pom.xml b/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.1.6</version>
+        <version>3.1.11</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
 
@@ -499,7 +499,7 @@
                 </plugin>
                 <plugin>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>2.22.2</version>
+                    <version>3.1.2</version>
                 </plugin>
                 <plugin>
                     <artifactId>maven-war-plugin</artifactId>
@@ -508,7 +508,7 @@
                 <plugin>
                     <groupId>org.jacoco</groupId>
                     <artifactId>jacoco-maven-plugin</artifactId>
-                    <version>0.8.10</version>
+                    <version>0.8.12</version>
                 </plugin>
             </plugins>
         </pluginManagement>