msgpack and javassist version

[ikappaki]

Hi,

JFrog Xray security analyser complains that the jboss-javassist/javassist 3.18.1-GA version which comes with msgpack/msgpack-java 0.6.12, has a known vulnerability (laconically captured in https://issues.redhat.com/browse/JASSIST-227) and should be upgraded to at least 3.19.0-GA (which has the fix).

I could not find any other reference to this vulnerability on the internet, and I am not aware where Xray source its security database from.

deps:

com.cognitect/transit-java 1.0.343
  . com.fasterxml.jackson.core/jackson-core 2.8.7
  . org.msgpack/msgpack 0.6.12
    . com.googlecode.json-simple/json-simple 1.1.1
    . org.javassist/javassist 3.18.1-GA
  . commons-codec/commons-codec 1.10
  . javax.xml.bind/jaxb-api 2.3.0

0.6.12 appears to be the last version in the 0.6 branch dating back to 2015. Perhaps this is also an opportunity to upgrade to a more recent release? v0.9 even claims "MessagePack v7 (or later) is a faster implementation of the previous version v06".

As a workaround, maven consumers can exclude org.javassist/javassist from transit-java and add a new dep on org.javassist/javassist 3.19.0-GA.

Thanks