From 326a8909fe7cf08c6c8bb61fe2e978d518caaa92 Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Thu, 14 Aug 2025 14:40:33 -0700 Subject: [PATCH 1/3] RUN-3602: Update Commons Compress --- build.gradle | 7 +++++++ gradle.properties | 2 ++ 2 files changed, 9 insertions(+) diff --git a/build.gradle b/build.gradle index e482e6e9..801d21b2 100644 --- a/build.gradle +++ b/build.gradle @@ -45,6 +45,13 @@ subprojects{ options.addBooleanOption('html5', true) } } + + // Mitigate CVE-2024-25710: Force commons-compress to 1.26.2 + configurations.all { + resolutionStrategy { + force "org.apache.commons:commons-compress:${commonsCompressVersion}" + } + } } /** diff --git a/gradle.properties b/gradle.properties index 76837905..131b2261 100644 --- a/gradle.properties +++ b/gradle.properties @@ -13,3 +13,5 @@ # See the License for the specific language governing permissions and # limitations under the License. # + +commonsCompressVersion=1.26.2 \ No newline at end of file From 9d4e3b75e2caba26c065f743607e0722b41e2525 Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Mon, 8 Sep 2025 15:11:09 -0300 Subject: [PATCH 2/3] update based on feedback Changed version to be pulled from libs.versions.toml --- build.gradle | 2 +- gradle.properties | 4 +--- gradle/libs.versions.toml | 3 +++ 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 801d21b2..78099713 100644 --- a/build.gradle +++ b/build.gradle @@ -49,7 +49,7 @@ subprojects{ // Mitigate CVE-2024-25710: Force commons-compress to 1.26.2 configurations.all { resolutionStrategy { - force "org.apache.commons:commons-compress:${commonsCompressVersion}" + force libs.commonsCompress } } } diff --git a/gradle.properties b/gradle.properties index 131b2261..dcd939a1 100644 --- a/gradle.properties +++ b/gradle.properties @@ -12,6 +12,4 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -# - -commonsCompressVersion=1.26.2 \ No newline at end of file +# \ No newline at end of file diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 0d49e91e..2aa75817 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -19,6 +19,7 @@ snakeYaml = "2.0" #used for authz lib integration rundeck = "4.17.6-20240402" testcontainers = "1.17.2" +commonsCompress = "1.26.2" [libraries] @@ -50,6 +51,8 @@ rundeckAuthzYaml = { module = "org.rundeck:rundeck-authz-yaml", version.ref = "r testcontainers = { module = "org.testcontainers:testcontainers", version.ref = "testcontainers" } testcontainersSpock = { module = "org.testcontainers:spock", version.ref = "testcontainers" } +commonsCompress = { module = "org.apache.commons:commons-compress", version.ref = "commonsCompress" } + [bundles] retrofit = ["retrofitCore", "retrofitJackson", "retrofitJaxb", "okhttpLogging", "okhttpUrlconnection", "jaxb"] From 413099ffe46f90c7c0ca8158b1a96e3b9de514aa Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Mon, 8 Sep 2025 16:31:22 -0300 Subject: [PATCH 3/3] Fix build issues --- gradle/verification-metadata.xml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index fb3fb834..dd78b766 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -63,6 +63,7 @@ + @@ -1859,6 +1860,11 @@ + + + + + @@ -2050,6 +2056,11 @@ + + + + + @@ -2120,6 +2131,11 @@ + + + + + @@ -3941,6 +3957,11 @@ + + + + +