Security issue on Java OpenSaml Library

[MIN ZHU]

Hi shibboleth developers,

    I am using opensaml-security-api Java lib in my project. As shown in
MavenRepository, the latest version is 3.4.5. (
https://mvnrepository.com/artifact/org.opensaml/opensaml-security-api/3.4.5)

    Then I ran a vulnerability check and found that there are two known
vulnerability in the dependencies:
    - org.cryptacular:cryptacular.    Denial of Service.    (Affected
version: [1.0,1.1.4) || [1.2.0,1.2.4) ). (
https://snyk.io/vuln/SNYK-JAVA-ORGCRYPTACULAR-543303)
    - org.apache.santuario:xmlsec.     XML External Entity (XXE)
Injection.   (Affected version: [2.0.3, 2.1.4) ). (
https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-460281)

    This is dependency tree of opensaml-security-api:

        +- org.opensaml:opensaml-security-api:jar:3.4.5:compile
        |  +- org.opensaml:opensaml-core:jar:3.4.5:compile
        |  |  +- joda-time:joda-time:jar:2.9:compile
        |  |  \- io.dropwizard.metrics:metrics-core:jar:4.1.7:compile
        |  +- org.opensaml:opensaml-messaging-api:jar:3.4.5:compile
        |  +- org.apache.santuario:xmlsec:jar:2.0.10:compile
        |  |  \- com.fasterxml.woodstox:woodstox-core:jar:5.0.3:compile
        |  |     \- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
        |  +- org.cryptacular:cryptacular:jar:1.1.3:compile
        |  +- net.shibboleth.utilities:java-support:jar:7.5.1:compile
        |  \- commons-codec:commons-codec:jar:1.14:compile

    May I know if you had any plan on these security issues?

    Thank you for your great work !

Best regards, MIN
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200617/87374edb/attachment.htm>