Addressing CVE-2025-48924 - adding constraint to build to ensure commons-lang3:3.18.0 is used

stecurran-est-tech · stecurran-est-tech · commit 66b4bf8decae · 2025-09-11T17:38:56.000+01:00
diff --git a/build.gradle b/build.gradle
@@ -324,6 +324,10 @@ project(':cruise-control') {
     constraints {
       implementation("commons-beanutils:commons-beanutils:1.11.0") {
         because("version 1.9.4 pulled from kafa 3.9.1 has CVE-2025-48734 in it, which is fixed in 1.11.0")
+        }
+        
+      implementation('org.apache.commons:commons-lang3:3.18.0') {
+        because("3.18.0 addresses vulnerability CVE-2025-48924")
       }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -324,6 +324,10 @@ project(':cruise-control') {`
`324`	`324`	`constraints {`
`325`	`325`	`implementation("commons-beanutils:commons-beanutils:1.11.0") {`
`326`	`326`	`because("version 1.9.4 pulled from kafa 3.9.1 has CVE-2025-48734 in it, which is fixed in 1.11.0")`
	`327`	`+ }`
	`328`	`+`
	`329`	`+ implementation('org.apache.commons:commons-lang3:3.18.0') {`
	`330`	`+ because("3.18.0 addresses vulnerability CVE-2025-48924")`
`327`	`331`	`}`
`328`	`332`	`}`
`329`	`333`