Skip to content

Used dependency AirCompressor contains vulnerabilities #411

Closed
Closed
Used dependency AirCompressor contains vulnerabilities#411
Labels
dependenciesPull requests that update a dependency file
Milestone
4.11.0

Description

@jkalq
jkalq
opened on Jan 5, 2026

Current release 4.10.4 uses aircompressor version 0.27 which contains https://nvd.nist.gov/vuln/detail/CVE-2025-67721, would it be possible to remedy this ?

Activity

  1. slawekjaranowski commented on Jan 6, 2026

    @slawekjaranowski
    slawekjaranowski
    on Jan 6, 2026
    Member

    PR is welcome

  2. wilx commented on Jan 6, 2026

    @wilx
    wilx
    on Jan 6, 2026

    I took a look. I don't think there is anything we can do here with the JVM compatibility constraints that this project, I assume, has. The versions 3.x of the aircompressor require at least Java 11. The version 2.0.2 is identical to 0.27 except the version number.

    TBH, I am not even sure if the 2.x and older are even affected.

  3. wilx commented on Jan 7, 2026

    @wilx
    wilx
    on Jan 7, 2026

    Welp. Someone needs to convince them to release 2.x with the fix: airlift/aircompressor#308 (comment)

  4. jkalq commented on Jan 7, 2026

    @jkalq
    jkalq
    on Jan 7, 2026
    Author

    There already appear to be pull requests fixing those vulnerabilities and some more and a request for a backport via an issue, but alas it has been three weeks without a reaction. Hoping it gets some traction soon.

    backport
    further backport for additional vulnerability

  5. slachiewicz commented on Jan 8, 2026

    @slachiewicz
    slachiewicz
    on Jan 8, 2026
    Member

    yes, just after I switched lib - they made new with Java version bump. Any alternative instead of aircomporesor?

  6. slachiewicz
    added
    dependenciesPull requests that update a dependency file
    on Jan 8, 2026

  7. wilx commented on Jan 8, 2026

    @wilx
    wilx
    on Jan 8, 2026

    OK. What about making the choice of the library a user responsibility? I tried excluding the aircompressor library from the plexus-archiver but I get class not found exception. I don't need Snappy support in my application. I have not checked the code, but how hard would it be to decouple the Snappy support providing library and the usage in plexus-archiver via something like ServiceLoader?

  8. slawekjaranowski commented on Jan 8, 2026

    @slawekjaranowski
    slawekjaranowski
    on Jan 8, 2026
    Member

    it is used

    https://github.com/search?q=repo%3Acodehaus-plexus%2Fplexus-archiver%20o.airlift.compress&type=code

    by snappy and tar archives, maybe can be removed usage from tar ...

  9. slachiewicz commented on Jan 9, 2026

    @slachiewicz
    slachiewicz
    on Jan 9, 2026
    Member

    I've replaced Airlift with (existing) commons-compress in #413

  10. slachiewicz
    modified the milestones: 4.11.1, 4.11.0 on Jan 10, 2026

  11. slachiewicz commented on Jan 10, 2026

    @slachiewicz
    slachiewicz
    on Jan 10, 2026
    Member

    I've released 4.11.0 - please check if works correctly

  12. slachiewicz
    closed this as completedon Jan 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dependenciesPull requests that update a dependency file

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions