Sonarqube正在进行核心漏洞查找。如何解决

Question

   "textRange": {
      "startLine": 1,
      "endLine": 1,
      "startOffset": 0,
      "endOffset": 38
    },
    "flows": [],
    "status": "OPEN",
    "message": "Filename: test-0.0.1-SNAPSHOT.jar: undertow-core-2.0.29.Final.jar 
| Reference: CVE-2020-1745 | CVSS Score: 9.8 | Category: CWE-200 | A file inclusion 
vulnerability was found 
in the AJP connector enabled with a default AJP configuration port of 8009 in 
Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, 
unauthenticated attacker could exploit this vulnerability to read web application files 
from a vulnerable server. In instances where the vulnerable server allows file uploads, 
an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file 
types and trigger this vulnerability to gain remote code execution.",

Undertow在pom上不可用，因为它是另一个依赖项的子项(spring-boot-starter-undertow，已更新到2.3.3版本的最新版本）。有没有一种方法，我可以使Spring启动有一个特定的版本下拖？

[INFO] +- org.springframework.boot:spring-boot-starter-undertow:jar:2.3.3.RELEASE:compile
[INFO] |  +- io.undertow:undertow-core:jar:2.0.29.Final:compile
[INFO] |  |  +- org.jboss.xnio:xnio-api:jar:3.3.8.Final:compile
[INFO] |  |  \- org.jboss.xnio:xnio-nio:jar:3.3.8.Final:runtime

[INFO] |  +- io.undertow:undertow-servlet:jar:2.0.29.Final:compile
[INFO] |  +- io.undertow:undertow-websockets-jsr:jar:2.0.29.Final:compile
[INFO] |  |  \- org.jboss.spec.javax.websocket:jboss-websocket-api_1.1_spec:jar:1.1.4.Final:compile
[INFO] |  +- jakarta.servlet:jakarta.servlet-api:jar:4.0.3:compile
[INFO] |  \- org.glassfish:jakarta.el:jar:3.0.3:compile

Answer 1

如果需要一个特定版本的Undertow，只需将其包含在pom.xml中：

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.0.30.Final</version>
</dependency>

通过这样做，您将覆盖可能通过其他依赖项获得的任何其他版本（包括Spring的版本）。

如果您需要的版本已经包含在某些其他包的依赖项中，并且您希望Spring使用该版本（而不是手动覆盖pom中的每个Undertow依赖项），则可以尝试仅排除Starter提供的版本：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
    <version>2.3.3.RELEASE</version> <!-- already includes undertow 2.0.30 -->
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
  <version>2.3.3.RELEASE</version>
  <exclusions>
    <exclusion>
      <groupId>io.undertow</groupId>
      <artifactId>undertow-core</artifactId>
    </exclusion>
  </exclusions>
</dependency>