Dependency on commons-text has vulnerability to CVE-2022-42889

[krageon]

Wiremock version

2.34.0

How I'm starting wiremock

I'm not - I'm simply scanning a wiremock image with trivy

A failing test case

You can run trivy image --ignore-unfixed --security-checks vuln wiremock/wiremock, which will among other things output the stated CVE.

What is the issue

Inside of the wiremock jar there is a META-INF folder containing a maven folder. There is a reference there to commons-text (an apache commons library) at version 1.9. I don't know how it gets there, because I cannot find any reference to it inside of the repository or inside of the gradle build dependencies. It's been a long time since I did jar file engineering, so I have only a vague notion that it is for pulling in dependencies at runtime from the internet.

What would I like to see

I'd like the dependency on commons-text to be gone if it is not needed, or to upgrade it to 1.10.0. That version doesn't have the vulnerability by default, which is nice.

Currently I can build a .jar by telling it exclude 'META-INF/maven/**' inside the shadowJar stage of the build.gradle file. This is probably very bad, and I'm still trying to figure out whether or not this breaks anything horrifically.

If someone could point me at some relevant docs that will explain to me how to upgrade this dependency I have no trouble creating a pull request.

[krageon]

https://github.com/aquasecurity/trivy

Trivy is found there

[lucasvc]

Handlerbars has published a 4.3.1 release fixing the CVE.
So other workaround is to include in your project also that library updated version.

[dubonzi]

Any plans to release a version with this fix? Our security scans are blocking wiremock due to this vulnerability.

[pcgeng]

Is there a workaround to fix CVE-2022-42889?

[krageon]

Apologies for leaving this open. The latest master does not have this issue, which I would say is the best workaround.

[lucasvc]

@pcgeng

Is there a workaround to fix CVE-2022-42889?

If you can't wait to the next Wiremock release, you can add in your project the dependency Handlebars at the 4.3.1 version (see the link how adding according to different build systems).

[ravxz]

Any plans for 2.34/2.35 release with this fix?

[lucasvc]

@ravxz It is being asked/informed in the PR#1995.