How to replace a certain java library version with another?

[Otto Myyrä]

Hi.

Due to a recent problem with apache-commons-text (CVE-2022-42889) we were trying to replace the commons-text-1.8 java library in our cas 6.1 deployment. I can get the non-vulnerable 1.10 version to be included in the build with an implementation clause in build.gradle, but the build still insists on copying also the vulnerable 1.8 version into the resulting war file.

If I use the exclude group functionality to prevent the 1.8 from being used, then the build fails because it can't find the 1.8 version.

How can I get the commons-text-1.10 to replace the commons-text-1.8 so that the 1.8 is not included in the built war file? Or is this even practical and I should be trying some completely different approach?

BR,

Otto Myyrä

[jm]

Hi,

I think my post will help: <https://blog.dragonslayer.me/archives/161>

Although this post is written in Chinese, please check the code snippet in the post, I think it's easy to understand.

In the post I tried to exclude log4j2 in the war, but you may change that to whatever you want.

[Otto Myyrä]

Thanks jm and Sven.

You managed to direct me to the correct direction.

There was actually a ready-made commented-out line in build.gradle under the bootWar declaration that excludes jars from the war without ruining the build process:

        cas {
            from "org.apereo.cas:cas-server-webapp${project.appServer}:${casServerVersion}@war"
            provided = false
            //excludes = ["WEB-INF/lib/somejar-1.0*"]
        }

Uncommented the line and replaced the somejar with common-text-1.8* and the war was built without the old version.

BR,

Otto Myyrä

On Wed, Oct 19, 2022 at 1:06 PM Sven Specker <spe...@rz.uni-frankfurt.de> wrote:

Hi!

You can search the archive of cas-user for the "log4j mitigation" of 2021.

There is a comprehensive example how to replace that. Just adjust it for
commons-text.

Best regards,

Sven Specker

--
__________________________________________________________________
*** Sven Specker -- University of Frankfurt Computing Center   ***
*********** UNIX System Administration (Auth/IDM) ****************
***** spe...@rz.uni-frankfurt.de [Phone (+49)-69-798-15188] *****
******************************************************************
__________________________________________________________________             
                Johann Wolfgang Goethe Universitaet
                   - Hochschulrechenzentrum -
                 Theodor W. Adorno-Platz 1 (PA-1P16)

                   D-60323 Frankfurt/Main
__________________________________________________________________
______________ TeX-users do it in {groups}________________________