Xerces2 dependency has security vulnerabilities.

[newmacuser611]

Hi,

Jacoco depends on maven Reporting Impl 2.1, which depends on Doxia 1.1.2, which depends on Xerces 2.8.1, which has this CVE:

CVE-2012-0881: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

This is classified as a HIGH severity vulnerability.

Upgrading to Maven Reporting Impl 3.0 resolves this issue, as 3.0 uses Doxia 1.7, which has no dependency on Xerces at all.

Thanks.

[marchof]

See previous discussion about maven build time dependences in #641

[Godin]

First of all there is absolutely no way to exploit CVE-2012-0881 via jacoco-maven-plugin because these transitive dependencies on doxia and xerces are actually not used at runtime. I'm omitting proof of this for the time being as a kind of exercise for potential contributors.

Also maven-reporting-impl can not be updated to 3.0, because it requires Java 6, whereas Maven 3.0 declares Java 5 as minimal required version and jacoco-maven-plugin declares Maven 3.0.

And here is other exercise - to me seems that possible to completely remove usage of maven-reporting-impl without losing any functionality.