CVE-2023-2976 reported for the component "com.google.guava:guava" in "build-info-extractor-maven3-2.40.0-uber.jar" file

[palaksahu1]

Describe the bug

the CVE-2023-2976 reported for the component "com.google.guava:guava" used in the "build-info-extractor-maven3-2.40.0-uber.jar" file which needs to be fixed.

Current behavior

the CVE-2023-2976 reported for the component "com.google.guava:guava" used in the "build-info-extractor-maven3-2.40.0-uber.jar" file which needs to be fixed.

Reproduction steps

1. Download the package build-info-extractor-maven3-2.40.0-uber.jar provided by JFrog and scan it with the help of Xray.

2. Xray will report the CVE-2023-2976 for the component "com.google.guava:guava" used in the "build-info-extractor-maven3-2.40.0-uber.jar" file which needs to be fixed as shown below:

Expected behavior

Build-info-extractor-maven3-2.40.0-uber.jar should not be vulnerable. If the above CVE gets fixed, there will be no violations.

JFrog CLI version

2.46.2

Operating system type and version

Rhel 8

JFrog Artifactory version

latest

JFrog Xray version

latest

[yahavi]

Thanks for reporting this issue @palaksahu1.
We created jfrog/build-info-go#192 to include jfrog/build-info#754 that should update Guava to 32.0.1-jre.

[yahavi]

@palaksahu1
JFrog CLI 2.46.3 has been released.
This version includes the upgrade of the Guava dependency.
We'd appreciate your feedback on that.

[palaksahu1]

Thank you @yahavi for the fix.