[SECURITY] Use HTTPS to resolve dependencies in Maven Build

This is a security fix for a high severity vulnerability in your Apache Maven pom.xml file(s).

The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS.

This leaves your build vulnerable to allowing a Man in the Middle (MITM) attackers to execute arbitrary code on your or your computer or CI/CD system.

这是针对Apache Maven pom.xml文件中的高严重漏洞的安全修复。

构建文件表明该项目正在解决HTTP而不是HTTPS上的依赖关系。

这使得您的构建很容易允许中间的人(MITM)攻击者在您或您的计算机或CI/CD系统上执行任意代码。

(HTTP的请求可以被劫持,是不安全的,所以可能会收到中间人攻击,使用HTTPS则可以修复该问题,具体fix solition 请看文章最后)

This vulnerability has a CVSS v3.0 Base Score of 8.1/10.

POC code has existed since 2014 to maliciously compromise a JAR file in-flight.

MITM attacks against HTTP are increasingly common, for example Comcast is known to have done it to their own users.

Resources

Source

This contribution was automatically generated with an OpenRewrite refactoring recipe, which was lovingly handcrafted ❤️ to bring this security fix to your repository.

The source code that generated this PR can be found here: UseHttpsForRepositories

Detecting this and Future Vulnerabilities

This vulnerability was automatically detected by GitHub's CodeQL using this CodeQL Query.

You can automatically detect future vulnerabilities, like this one, by enabling the free (for open-source) CodeQL: GitHub Action.

I'm not an employee of GitHub, I'm simply an open-source security researcher for the Open Source Security Foundation.

Opting Out

If you'd like to opt out of future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt to your repository with the line:

复制代码
User-agent: JLLeitschuh/security-research
Disallow: *

This bot will respect the ROBOTS.txt format for future contributions.

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

All contributed commits are already automatically signed off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin

(see Developer Certificate of Origin for more information).

Sponsorship & Support

This work was originally sponsored by HUMAN Security Inc. and the new Dan Kaminsky Fellowship, a fellowship created to celebrate Dan's memory and legacy by funding open-source work that makes the world a better (and more secure) place.

This work was later sponsored by Open Source Security Foundation (OpenSSF): Project Alpha-Omega.

Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code -- and get them fixed -- to improve global software supply chain security.

This PR was generated with Moderne, a free-for-open source SaaS offering that uses format-preserving AST transformations to fix bugs, standardize code style, apply best practices, migrate library versions, and fix common security vulnerabilities at scale.

Tracking

All PR's generated as part of this fix are tracked here: JLLeitschuh/security-research#8

Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

fix solution修复指南

可以参考

maven仓库设置阿里云镜像加速(https://maven.aliyun.com/repository/public)_阿里云搜索maven加速-CSDN博客文章浏览阅读2.9k次。maven在国内连接到中央仓库下载jar包太慢了,如果想加速的话,可以切换到阿里云maven镜像库2023.12.17更新,更新https连接和更新新版阿里云链接下载jar包的时候很快,但是缺点就是maven相关的包比较慢_阿里云搜索maven加速https://blog.csdn.net/moshowgame/article/details/79912737

打开 maven 的配置文件( windows 机器一般在 maven 安装目录的conf/settings.xml ),在<mirrors></mirrors>标签中添加 mirror 子节点:

复制代码
<mirror>
  <id>aliyunmaven</id>
  <mirrorOf>*</mirrorOf>
  <name>阿里云公共仓库</name>
  <url>https://maven.aliyun.com/repository/public</url>
</mirror>
相关推荐
乖女子@@@7 小时前
协议_https协议
http·https·iphone
Katherine_lin8 小时前
UDP特点及报文结构
网络·网络协议·udp
q567315238 小时前
自动化拨号爬虫体系:虚拟机集群部署与增量管理
运维·爬虫·网络协议·自动化
刘 大 望9 小时前
传输层:UDP/TCP协议
java·网络·网络协议·tcp/ip·udp·信息与通信
彬彬醤12 小时前
TikTok矩阵有哪些运营支撑方案?
大数据·网络·网络协议·tcp/ip·矩阵·udp·产品运营
楠枬13 小时前
DNS 域名解析
服务器·网络·网络协议
上官浩仁14 小时前
springboot maven 多环境配置入门与实战
java·spring boot·maven
元直数字电路验证14 小时前
新建Jakarta EE项目,Maven Archetype 选项无法加载出内容该怎么办?
java·maven
麦兜*14 小时前
Docker 部署 MongoDB:单节点与副本集的最佳实践
java·spring boot·mongodb·spring cloud·docker·容器·maven
天上的光15 小时前
计算机网络——协议
网络·网络协议