https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.4 中的“漏洞”有什么意义？

Question

Here I need to search latest version of dependency which is not vulnerable but as I navigate to maven repository page https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.4 , I see there is also vulnerabilities written under 'Vulnerabilities' section. I am in dilemma, whether this indicates a resolved vulnerability for given version or persisted still. Please clear whether this version is vulnerable or not?

 <:-- https.//mvnrepository.com/artifact/commons-fileupload/commons-fileupload --> <dependency> <groupId>commons-fileupload</groupId> <artifactId>commons-fileupload</artifactId> <version>1.4</version> </dependency>

Snapshot-->

Answer 1

Issue was reported in commons-fileupload FILEUPLOAD-347

There are two vulnerabilities from dependencies:

• one on junit - it is not propagated to end user
• second - it's depends if commons-fileupload use method FileNameUtils.normalize from commons-io - to check in source code

The best way is follow and / or ask such question in project tracking issue.