From aa02a3db013686ec375b2f582283732c8fd7f447 Mon Sep 17 00:00:00 2001
From: zrj <646384940@qq.com>
Date: Thu, 13 Jun 2024 15:40:09 +0800
Subject: [PATCH] 漏洞修复
---
pom.xml | 40 ++++++++++++++++++++++++++++++++++++++--
1 files changed, 38 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index d478d44..7076141 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
- <spring.boot.version>2.7.1</spring.boot.version>
+ <spring.boot.version>2.7.15</spring.boot.version>
<spring.platform.version>Cairo-SR8</spring.platform.version>
<!-- 推荐使用Harbor -->
@@ -220,7 +220,43 @@
<version>5.5.4</version>
<scope>compile</scope>
</dependency>
-
+ <!--漏洞覆盖之前 1.3.0 版本-->
+ <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
+ <dependency>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
+ <version>2.0</version>
+ </dependency>
+ <!-- FileUpload 依赖 升级 （漏洞版本 1.3.3）-->
+ <dependency>
+ <groupId>commons-fileupload</groupId>
+ <artifactId>commons-fileupload</artifactId>
+ <version>1.5</version>
+ </dependency>
+ <!-- IO 依赖，FileUpload 需要 Commons IO 库 -->
+ <dependency>
+ <groupId>commons-io</groupId>
+ <artifactId>commons-io</artifactId>
+ <version>2.8.0</version>
+ </dependency>
+ <!-- 排除 velocity 1.7 有漏洞-->
+ <dependency>
+ <groupId>com.bstek.ureport</groupId>
+ <artifactId>ureport2-console</artifactId>
+ <version>2.2.9</version>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.velocity</groupId>
+ <artifactId>velocity</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <!--覆盖原来的 8.0.22 有漏洞-->
+ <dependency>
+ <groupId>mysql</groupId>
+ <artifactId>mysql-connector-java</artifactId>
+ <version>8.0.27</version>
+ </dependency>
</dependencies>
<build>
--
Gitblit v1.9.3