Dependency org.apache.commons:commons-compress, leading to CVE problem

[CVEDetect]

Hi, In hawtjni/hawtjni-maven-plugin，there is a dependency org.apache.commons:commons-compress:1.20 that calls the risk method.

CVE-2018-11771

The scope of this CVE affected version is [,1.18-RC1)

After further analysis, in this project, the main Api called is <org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int readStored(byte[],int,int)>

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 7

<org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int readStored(byte[],int,int)>
at <org.apache.commons.compress.archivers.zip.ZipArchiveInputStream: int read(byte[],int,int)> (org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.java:[486]) in /.m2/repository/org/apache/commons/commons-compress/1.20/commons-compress-1.20.jar
at <org.codehaus.plexus.archiver.util.Streams: void copyFullyDontCloseOutput(java.io.InputStream,java.io.OutputStream,java.lang.String)> (org.codehaus.plexus.archiver.util.Streams.java:[139]) in /.m2/repository/org/codehaus/plexus/plexus-archiver/4.2.2/plexus-archiver-4.2.2.jar
at <org.codehaus.plexus.archiver.tar.TarArchiver: void tarFile(org.codehaus.plexus.archiver.ArchiveEntry,org.apache.commons.compress.archivers.tar.TarArchiveOutputStream,java.lang.String)> (org.codehaus.plexus.archiver.tar.TarArchiver.java:[339]) in /.m2/repository/org/codehaus/plexus/plexus-archiver/4.2.2/plexus-archiver-4.2.2.jar
at <org.codehaus.plexus.archiver.tar.TarArchiver: void execute()> (org.codehaus.plexus.archiver.tar.TarArchiver.java:[169]) in /.m2/repository/org/codehaus/plexus/plexus-archiver/4.2.2/plexus-archiver-4.2.2.jar
at <org.codehaus.plexus.archiver.AbstractArchiver: void createArchive()> (org.codehaus.plexus.archiver.AbstractArchiver.java:[1042]) in /.m2/repository/org/codehaus/plexus/plexus-archiver/4.2.2/plexus-archiver-4.2.2.jar
at <org.fusesource.hawtjni.maven.PackageJarMojo: void execute()> (org.fusesource.hawtjni.maven.PackageJarMojo.java:[135]) in /detect/unzip/hawtjni-master/hawtjni-maven-plugin/target/classes

Dependency tree--

[INFO] org.fusesource.hawtjni:hawtjni-maven-plugin:maven-plugin:1.19-SNAPSHOT
[INFO] +- org.fusesource.hawtjni:hawtjni-generator:jar:1.19-SNAPSHOT:compile
[INFO] +- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-model:jar:3.6.3:compile
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
[INFO] |  |  +- javax.enterprise:cdi-api:jar:1.0:compile
[INFO] |  |  |  +- javax.annotation:jsr250-api:jar:1.0:compile
[INFO] |  |  |  \- javax.inject:javax.inject:jar:1:compile
[INFO] |  |  +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
[INFO] |  |  \- org.codehaus.plexus:plexus-component-annotations:jar:1.5.5:compile
[INFO] |  \- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
[INFO] +- org.apache.maven:maven-project:jar:2.0.11:compile
[INFO] |  +- org.apache.maven:maven-settings:jar:2.0.11:compile
[INFO] |  +- org.apache.maven:maven-profile:jar:2.0.11:compile
[INFO] |  +- org.apache.maven:maven-plugin-registry:jar:2.0.11:compile
[INFO] |  \- org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9-stable-1:compile
[INFO] |     +- junit:junit:jar:3.8.1:compile
[INFO] |     \- classworlds:classworlds:jar:1.1-alpha-2:compile
[INFO] +- org.codehaus.plexus:plexus-utils:jar:3.3.0:compile
[INFO] +- org.codehaus.plexus:plexus-interpolation:jar:1.26:compile
[INFO] +- org.apache.maven:maven-artifact-manager:jar:2.0.11:compile
[INFO] |  +- org.apache.maven:maven-repository-metadata:jar:2.0.11:compile
[INFO] |  \- org.apache.maven.wagon:wagon-provider-api:jar:1.0-beta-2:compile
[INFO] +- org.apache.maven:maven-artifact:jar:2.0.11:compile
[INFO] +- org.apache.maven:maven-archiver:jar:2.4:compile
[INFO] +- org.codehaus.plexus:plexus-archiver:jar:4.2.2:compile
[INFO] |  +- org.apache.commons:commons-compress:jar:1.20:compile
[INFO] |  +- org.iq80.snappy:snappy:jar:0.4:compile
[INFO] |  \- org.tukaani:xz:jar:1.8:runtime
[INFO] +- org.codehaus.plexus:plexus-io:jar:3.2.0:compile
[INFO] |  \- commons-io:commons-io:jar:2.6:compile
[INFO] \- org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.6.0:provided

Suggested solutions:

Update dependency version

Thank you very much.

[CVEDetect]

@hboutemy
Could please help me check this issue?
May I pull a request to fix it?
Thanks again.

[castortech]

Not sure why this is being reported, since it applies only to versions prior to 1.18RC1 and as your log shows, HawtJNI is using 1.20 that is not affected AFAICT