[CVEs] Critical and High CEVs reported on PMD and PMD dependencies

[eugenepugach]

Affects PMD Version:
7.0.0-rc3

Description:
Hello PMD team. We scanned PMD source code with Snyk and another system it reported 2 critical and 1 high CVEs.
Also this vulnerabilities block deployment and creating Docker image and another servers:

Vulnerable Library: scala-reflect-2.13.3.jar (/dist/pmd-bin/lib/scala-reflect-2.13.3.jar)

Dependency Hierarchy:

Directly - ⚠️ scala-reflect-2.13.3.jar (Vulnerability Library)

Severity:
🚫 CRITICAL
CVE-2022-36944

Fixed Version:
♻️ scala-reflect-2.13.9.jar

---

Vulnerable Library: scala-reflect-2.13.3.jar (/dist/pmd-bin/lib/scala-reflect-2.13.3.jar)

Dependency Hierarchy:

Directly - ⚠️ scala-reflect-2.13.3.jar (Vulnerability Library)

Severity:
🚫 CRITICAL
VULNDB-298991

Fixed Version:
♻️ scala-reflect-2.13.9.jar

---

Vulnerable Library: commons-io (/dist/pmd-bin/lib/pmd-ui-7.0.0-rc1.jar:commons-io)

Dependency Hierarchy:

• ⚠️ pmd-ui-7.0.0-rc1.jar (Root Library)
• ⚠️ commons-io (Vulnerability Library)

Severity:
🚫 HIGH
VULNDB-239195

Fixed Version:
♻️ commons-io-2.8.0.jar

[adangel]

Thanks for reporting.

Updating scala from 2.13.3 to 2.13.9 should be simple.
the common-io dependency seems to stem from https://github.com/pmd/pmd-designer ...

[adangel]

@eugenepugach Can you provide details what "VULNDB-298991" is? VulnDb seems to be behind a paywall (https://vulndb.cyberriskanalytics.com/).

VULNDB-239195 I found being mentioned at https://issues.apache.org/jira/browse/FLINK-22747