如何删除 com.thoughtworks.xstream_xstream 关键漏洞？

Question

I have a spring boot application. When I add this plugin

 <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>

in the Build section, I am getting these vulnerabilities.

| CVE-2021-21345   | critical  | 9.90 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21350   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21347   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21346   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21344   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21351   | critical  | 9.10 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability may allow a       |
|                  |           |      |                                             |                      |                                              |             |            | remote at...                                       |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21342   | critical  | 9.10 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability where the         |
|                  |           |      |                                             |                      |                                              |             |            | processed s...          

I also tried to add this in the dependencies section but still, it is giving the same.

 <dependency>
      <groupId>com.thoughtworks.xstream</groupId>
      <artifactId>xstream</artifactId>
      <version>1.4.18</version>
    </dependency>

What should I change in my POM.xml to remove these Vulnerabilities?

Answer 1

You can check maven documentation for any known vulnerabilities associated with any nested dependency: https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-maven-plugin

seems that you are using specific old version of the plugin which has those vulnerabilities, try to update to the latest one.