The information related to Repository, Group, Artifact, Version and Problem Code are extracted from the CLM report (see the below screenshot)
| Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| msb-apigateway | com.fasterxml.jackson.core | False Positive Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-apigateway doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-apigateway. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-apigateway codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
| msb-apigateway | org.springframework | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | |
| msb-apigateway | commons-collections | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
| msb-apigateway | commons-beanutils | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
| msb-apigateway | org.webjars bootstrap | The bug has been fixed in upstream project, but not included in its latest release yet, it will be updated once the upstream project release the new version. | |
| msb-apigateway | org.webjars bootstrap | NO INFORMATION | |
| msb-apigateway | org.webjars bootstrap | NO INFORMATION | |
| msb-discovery | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-discovery codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
| msb-java-sdk | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-java-sdk codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
| msb-java-sdk | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-java-sdk codes using ObjectMapper: | |
msb-swagger-sdk | com.fasterxml.jackson.core | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | com.fasterxml.jackson.core | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | com.fasterxml.jackson.dataformat | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | commons-beanutils | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | commons-collections | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |