CVE vulnerabilities on qlack-fuse-lexikon

[kliarist]

The following vulnerabilities are being produced when running dependency check:

batik-all-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-all@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-rasterizer-ext-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-rasterizer-ext@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-rasterizer-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-rasterizer@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-svgrasterizer-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-svgrasterizer@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-codec-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-codec@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-squiggle-ext-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-squiggle-ext@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-squiggle-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-squiggle@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-svgbrowser-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-svgbrowser@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-svgpp-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-svgpp@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*, cpe:2.3:a:svgpp:svgpp:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-extension-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-extension@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-slideshow-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-slideshow@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-swing-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-swing@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-ttf2svg-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-ttf2svg@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987
batik-gui-util-1.13.jar (pkg:maven/org.apache.xmlgraphics/batik-gui-util@1.13, cpe:2.3:a:apache:batik:1.13:*:*:*:*:*:*:*) : CVE-2020-11987

All of the above batik v1.13 dependencies are transitively fetched via the org:apache:poi:5.0.0.

Going forward here are a few ways to resolve the issue:

• Suppress via the owasp-suppression.xml file and in particular by including:

<suppress>
    <notes><![CDATA[
   file name: batik-*.jar
   ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.xmlgraphics/batik.*@.*$</packageUrl>
    <cpe>cpe:/a:apache:batik</cpe>
    <cve>CVE-2020-11987</cve>
  </suppress>

• Investigate whether poi & batik dependencies are indeed needed and if not remove altogether
• Manually exclude batik v1.13 dependencies and upgrade to batik v1.14, which will eliminate the vulnerabilities.