如何删除 com.thoughtworks.xstream_xstream 关键漏洞？

Question

我有一个 spring 启动应用程序。 当我添加这个插件

 <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>

在构建部分，我得到了这些漏洞。

| CVE-2021-21345   | critical  | 9.90 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21350   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21347   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21346   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21344   | critical  | 9.80 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability which may allow a |
|                  |           |      |                                             |                      |                                              |             |            | rem...                                             |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21351   | critical  | 9.10 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability may allow a       |
|                  |           |      |                                             |                      |                                              |             |            | remote at...                                       |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21342   | critical  | 9.10 | com.thoughtworks.xstream_xstream            | 1.4.7                | fixed in 1.4.16                              | > 1 years   | < 1 hour   | XStream is a Java library to serialize objects     |
|                  |           |      |                                             |                      | > 1 years ago                                |             |            | to XML and back again. In XStream before version   |
|                  |           |      |                                             |                      |                                              |             |            | 1.4.16, there is a vulnerability where the         |
|                  |           |      |                                             |                      |                                              |             |            | processed s...          

我也尝试在依赖项部分添加它，但仍然给出相同的结果。

 <dependency>
      <groupId>com.thoughtworks.xstream</groupId>
      <artifactId>xstream</artifactId>
      <version>1.4.18</version>
    </dependency>

我应该在我的 POM.xml 中更改什么来删除这些漏洞？

Answer 1

您可以查看 maven 文档以了解与任何嵌套依赖项相关的任何已知漏洞： https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-maven-plugin

似乎您正在使用具有这些漏洞的特定旧版本插件，请尝试更新到最新版本。