Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Adal4j" library is not optional in 21.0.0.-legacy release #3596

Open
Babak-abd opened this issue Jul 25, 2024 · 3 comments
Open

"Adal4j" library is not optional in 21.0.0.-legacy release #3596

Babak-abd opened this issue Jul 25, 2024 · 3 comments

Comments

@Babak-abd
Copy link
Contributor

Babak-abd commented Jul 25, 2024

Describe the bug
On #3175 PR, Adal was marked as Optional but when i am looking at 21.0.0-legacy on mvn repository, it does not show it as optional.
I am sure that at one point, I saw it optional and our security scans did not report this.

now with this version, our scans are showing CVE-2021-31684 and CVE-2023-1370 which is related to nimbus-jose-jwt-9.8.1.jar and json-smart-2.4.2.jar libraries.
Client Version
21.0.0.-legacy

@Babak-abd Babak-abd changed the title "Adal" library is not optional in 21.0.0.-legacy release "Adal4j" library is not optional in 21.0.0.-legacy release Jul 25, 2024
@Babak-abd
Copy link
Contributor Author

not sure if its related but should https://github.com/kubernetes-client/java/blob/release-legacy-21/util/pom.xml#L62 be also optional?

@brendandburns
Copy link
Contributor

I think we need to backport #3560 into the legacy branch.

The basic bug is that mvn appears to not respect inheritance of optional in child poms.

@kevinh-hcl
Copy link

thank you for backporting this. is there any date scheduled for the 21.0.1 legacy version to be built with those changes?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants