From 7dc9a4602baf79cef7b62591a7dc6d27390f01b5 Mon Sep 17 00:00:00 2001 From: Patrick Boos Date: Fri, 5 Dec 2025 08:32:18 +0100 Subject: [PATCH] [CHK-12903] Fix dependabot alert 29 (org.mozilla:rhino) --- openapi-validation-core/build.gradle | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openapi-validation-core/build.gradle b/openapi-validation-core/build.gradle index 4a2962fc..3d59b07a 100644 --- a/openapi-validation-core/build.gradle +++ b/openapi-validation-core/build.gradle @@ -10,6 +10,9 @@ dependencies { implementation(libs.commons.codec) { because 'Apache commons-codec before 1.13 is vulnerable to information exposure. See https://devhub.checkmarx.com/cve-details/Cxeb68d52e-5509/' } + implementation('org.mozilla:rhino:1.7.14.1') { + because 'CVE-2025-66453: Rhino before 1.7.14.1 has high CPU usage and potential DoS when passing specific numbers to toFixed() function. See https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x' + } // implementation('org.yaml:snakeyaml:1.33') { // because 'Vulnerability in 1.33 is not yet fixed. See: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in' + // 'https://devhub.checkmarx.com/cve-details/CVE-2022-41854/' +