Vulnerable dependency

[EvanKnowles]

IntelliJ is flagging the totp library for one of its dependencies:

Dependency maven:com.beust:jcommander:1.72 is vulnerable

Upgrade to 1.75

WS-2019-0490, Score: 8.1

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Read More: https://www.mend.io/vulnerability-database/WS-2019-0490?utm_source=JetBrains

[mesketh]

IntelliJ is flagging the totp library for one of its dependencies:

Dependency maven:com.beust:jcommander:1.72 is vulnerable

Upgrade to 1.75

WS-2019-0490, Score: 8.1

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Read More: https://www.mend.io/vulnerability-database/WS-2019-0490?utm_source=JetBrains

Hi - in the meantime folks can just exclude those vulns and include direct deps to them e.g.

<dependency>
      <groupId>dev.samstevens.totp</groupId>
      <artifactId>totp-spring-boot-starter</artifactId>
      <version>1.7.1</version>
      <exclusions>
        <exclusion>
          <groupId>com.beust</groupId>
          <artifactId>jcommander</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.apache.commons</groupId>
          <artifactId>commons-compress</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>com.beust</groupId>
      <artifactId>jcommander</artifactId>
      <version>1.82</version>
    </dependency>

    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-compress</artifactId>
      <version>1.27.1</version>
      <exclusions>
        <exclusion>
          <groupId>commons-lang</groupId>
          <artifactId>commons-lang</artifactId>
        </exclusion>
      </exclusions>
    </dependency>