Skip to content

Commit 4fb2cab

Browse files
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
This fixes a security vulnerability in this project where the `pom.xml` files were configuring Maven to resolve dependencies over HTTP instead of HTTPS. Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere Severity: High CVSSS: 8.1 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories) Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Bug-tracker: JLLeitschuh/security-research#8 Co-authored-by: Moderne <team@moderne.io>
1 parent d67ac40 commit 4fb2cab

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@
202202
</snapshots>
203203
<id>repo1Snapshots</id>
204204
<name>Repo1 Snapshots</name>
205-
<url>http://repo1.maven.org/maven2</url>
205+
<url>https://repo1.maven.org/maven2</url>
206206
<layout>default</layout>
207207
</repository>
208208

0 commit comments

Comments
 (0)