New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

io.pact.plugin.driver:core - Migrate from jarchivelib to compress4j #79

Open

pmottmwi opened this issue Nov 19, 2024 · 0 comments

pmottmwi commented Nov 19, 2024

The jarchivelib project is no longer maintained (see here), and contains some vulnerabilities due to using old library versions (specifically CVE-2024-25710 and CVE-2024-26308 in Apache Commons Compress 1.21).

These issues have been resolved in Compress4J, which is a fork of jarchivelib that is actively maintained and addresses these vulnerabilities.

I would recommend migrating to compress4j for future versions of the driver:core plugin in order to remove these vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment