cve-resolution-strategy.gradle

configurations.all {
    resolutionStrategy {
        eachDependency { DependencyResolveDetails det ->
            /* JAR upgrades with latest versions for CVE fixes*/

            /*
            * CVE-2022-42252
            * */
            if (det.requested.name == 'tomcat-embed-core') {
                det.useVersion '9.0.88'
            }
            if (det.requested.name == 'tomcat-embed-websocket') {
                det.useVersion '9.0.88'
            }

            /*
                CVE-2023-35116
            * */
            if (det.requested.name == 'jackson-databind') {
                det.useVersion '2.17.1'
            }

            /*
                CVE-2023-35116
            * */
            if (det.requested.name == 'jackson-annotations') {
                det.useVersion '2.17.1'
            }

            /*
                CVE-2023-35116
            * */
            if (det.requested.name == 'jackson-core') {
                det.useVersion '2.17.1'
            }

            /*
                 Prototype pollution Vulnerability
            * */
            if (det.requested.name == 'handlebars') {
                det.useVersion '4.4.0'
            }

            /*
                CVE-2021-28165, CVE-2021-28163, CVE-2021-28164, CVE-2021-28165, CVE-2021-28169, CVE-2021-34429
            * */
            if (det.requested.name == 'jetty-client' || det.requested.name == 'jetty-continuation' || det.requested.name == 'jetty-http'
                    || det.requested.name == 'jetty-security' || det.requested.name == 'jetty-servlet' || det.requested.name == 'jetty-servlets'
                    || det.requested.name == 'jetty-util' || det.requested.name == 'jetty-webapp' || det.requested.name == 'jetty-xml'
                    || det.requested.name == 'jetty-server' || det.requested.name == 'jetty-_http_server' || det.requested.name == 'jetty-util-ajax'
                    || det.requested.name == 'mortbay_jetty' || det.requested.name == 'jetty-io') {
                det.useVersion '9.4.54.v20240208'
            }

            /*
                CVE-2020-13956
            * */
            if (det.requested.name == 'httpclient') {
                det.useVersion '4.5.13'
            }

            /*
                For compatibility with Powermockito
            */
            if (det.requested.group == 'org.mockito') {
                det.useVersion '3.12.1'
            }

            /*
                CVE-2020-15250
            * */
            if (det.requested.name == 'junit' && det.requested.group == 'junit') {
                det.useVersion '4.13.1'
            }

            /*
                CVE-2019-10086
            */
            if (det.requested.name == 'commons-beanutils') {
                det.useVersion '1.9.4'
            }

            /*
                CVE-2019-0223
            * */
            if (det.requested.name == 'proton-j') {
                det.useVersion '0.33.8'
            }

            /*
                CVE-2018-10237
            * */
            if (det.requested.name == 'guava') {
                det.useVersion '33.2.0-jre'
            }

            if (det.requested.name == 'liquibase-core') {
                det.useVersion '4.27.0'
            }

            /*
                CVE-2022-25857
            * */
            if (det.requested.name == 'snakeyaml') {
                det.useVersion '2.2'
            }

            /*
                CVE-2012-6708, CVE-2015-9251, CVE-2019-11358
            **/
            if (det.requested.name == 'ff4j-web') {
                det.useVersion '1.8.11'
            }

            /* CVE-2021-29425 */
            if (det.requested.name == 'commons-io') {
                det.useVersion '2.16.1'
            }

            /*CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090, CVE-2024-26308*/
            if (det.requested.name == 'commons-compress') {
                det.useVersion '1.26.0'
            }

             /* CVE-2021-28170 */
            if (det.requested.name == 'jakarta.el') {
                det.useVersion '4.0.1'
            }

            /* CVE-2022-25647 */
            if (det.requested.name == 'gson' && det.requested.group == 'com.google.code.gson') {
                det.useVersion '2.9.0'
            }

            /*
            * CVE-2023-6481
            * */
            if (det.requested.name == 'logback-core' || det.requested.name == 'logback-classic' ) {
                det.useVersion '1.2.13'
            }

            /* CVE-2023-34042 */
            if (det.requested.name == 'org.springframework.security' || det.requested.name == 'spring-security-web' || det.requested.name == 'spring-security-core'
                    || det.requested.name == 'spring-security-config' || det.requested.name == 'spring-security-crypto') {
                det.useVersion '5.8.12'
            }

            /* CVE-2016-1000027, CVE-2024-22243, CVE-2024-22262 */
            if (det.requested.name == 'spring-core' || det.requested.name == 'spring-beans' || det.requested.name == 'spring-webmvc' || det.requested.name == 'spring-web' || det.requested.name == 'spring-context') {
                det.useVersion '5.3.29'
            }

            /* CVE-2024-1597 */
            if (det.requested.name == 'postgresql' && det.requested.group == 'org.postgresql') {
                det.useVersion '42.7.3'
            }

            /* CVE-2021-27568, CVE-2023-1370 */
            if (det.requested.name == 'json-smart'){
                det.useVersion '2.5.1'
            }

            /* CVE-2023-38286 */
            if (det.requested.name == 'thymeleaf') {
                det.useVersion '3.1.2.RELEASE'
            }

            /* CVE-2023-38286 */
            if (det.requested.name == 'spring-boot-starter-thymeleaf') {
                det.useVersion '3.2.5'
            }

            /* CVE-2023-38286 */
            if (det.requested.name == 'thymeleaf-spring5') {
                det.useVersion '3.1.2.RELEASE'
            }

            if (det.requested.name == 'com.google.guava' && det.requested.group == 'guava') {
                det.useVersion '33.2.0-jre'
            }

            if (det.requested.group == 'jaxb-osgi') {
                det.useVersion '4.0.5'
            }

        }
    }
}