[Snyk: High] XML External Entity (XXE) Injection (Due 07/10/2020)

[hcaofec]

Summary

High severity vulnerability found
Description:

XML External Entity (XXE) Injection
Vulnerable module: org.postgresql:postgresql
Introduced through: org.flywaydb:flyway-commandline@5.2.4
Exploit maturity: No known exploit
Detailed paths
Introduced through: project@0.0.0 › org.flywaydb:flyway-commandline@5.2.4 › org.postgresql:postgresql@42.2.5.jre6

More information: https://app.snyk.io/vuln/SNYK-JAVA-ORGPOSTGRESQL-571481

Technical considerations

• this vulnerability is found in build.gradle

[jason-upchurch]

fixed with following addition to build.gradle:

exclude group: 'com.google.guava', module: 'guava'
constraints {
    implementation('org.postgresql:postgresql:42.2.14.jre6')
}