From de911ce469318bbcefffbc108924c9cd6812e2dc Mon Sep 17 00:00:00 2001
From: Mark Nolan <manolan@gmail.com>
Date: Wed, 19 Aug 2020 11:15:28 +0100
Subject: [PATCH] [MNG-6965] - Quick fix by adding dependency

---
 archetype-packaging/pom.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/archetype-packaging/pom.xml b/archetype-packaging/pom.xml
index e4e6c3bda..4c20cb9c0 100644
--- a/archetype-packaging/pom.xml
+++ b/archetype-packaging/pom.xml
@@ -33,4 +33,25 @@
   <name>Maven Archetype Packaging</name>
   <description>'maven-archetype' packaging configuration for archetypes.</description>
 
+<!-- 
+  All Maven plugins have an implicit dependency on plexus-utils.
+  If no version is explicitly specified, they will have a 
+  dependency on plexus-utils:1.1 injected by 
+  org.apache.maven.plugin.internal.PlexusUtilsInjector.
+  
+  This is an extremely old version, with many known vulnerabilities,
+  so this change makes the dependency explicit in order to
+  respect the parents' dependencyManagement.
+  
+  Better solutions would be to remove that injection or make 
+  it respect the dependencyManagement declarations.
+  
+  See MNG-6965
+ -->
+  <dependencies>
+  	<dependency>
+      <groupId>org.codehaus.plexus</groupId>
+      <artifactId>plexus-utils</artifactId>
+  	</dependency>
+  </dependencies>
 </project>
\ No newline at end of file