Improve GHSA-7g54-vgp6-jj5w

[wtwhite]

Updates

• Affected products

Comments
Several other components are also affected as a result of cloning (copying source code) or shading (copying source code and renaming packages). Proof-of-Vulnerability projects with tests to verify the presence of the CVE can be found here: https://github.com/jensdietrich/xshady-release/.

See #2258, especially #2258 (comment), for more details.

[darakian]

Similar to #2826
Do you know if this has the same fix given that it's in the same groupID?

[wtwhite]

Hi @darakian,

Yes, I expect this will have the same fix as for #2826.

[wtwhite]

Hi @darakian,

We were able to confirm that the next (and only) version available on the Maven Central Repo, namely 1.1.0, is not vulnerable, so I've added a "fixed": "1.1.0" entry in 002cc26. The commit you found for #2826 (apache/sling-org-apache-sling-xss@de32b14) applies here too -- thanks for that!

Is this PR now good to go?

We confirmed non-vulnerability of 1.1.0 using the same manually-tweaked pom.xml as for #2826 -- I've put the working version at https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-6798/NOT-VULNERABLE/org.apache.sling__org.apache.sling.xss.compat__1.1.0.

[advisory-database]

Hi @wtwhite! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!