Mitigating a libsoup vulnerability in a Java 17 app

Question

I have a Java 17 app that I am trying to mitigate CVE vulnerabilities for.

Most of them have been pretty straightforward. Typically it's just a matter of inserting a dependency in the pom.xml file that updates the version to one that has been fixed according to the CNARS report.

For example, if the report says the current version of 1.19 for the package org.apache.commons:commons-compress is generating a severe vulnerability that is fixed in 1.21, I just insert the following into the pom.xml file:

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-compress</artifactId>
    <version>1.21.0</version>
</dependency>

But I'm kind of stuck on a vulnerability caused by a libsoup package.

The report says the current version of 2.62.3-7.el8_10 is fixed in 0:2.62.3-8.el8_10 and that the vulnerability was introduced in

LABEL org.opencontainers.image.description="ubi8-minimal with java 17

Doing something like this:

<dependency>
    <groupId>libsoup</groupId>
    <version>0:2.62.3-8.el8_10</version>
</dependency>

in the pom.xml file doesn't work because the repository can't even find anything with libsoup in the name or group.

Can anyone point me in the right direction?

Thank you.

Nikolai Shevchenko · Accepted Answer · 2025-05-16 04:29:38Z

0

That's because libsoup is not a maven artifact, but a package in Oracle's linux image distribution

https://security.snyk.io/vuln/SNYK-ORACLE8-LIBSOUP-10062725

How to fix?

Upgrade Oracle:8 libsoup to version 0:2.62.3-8.el8_10 or higher.
This issue was patched in ELSA-2025-4560.

answered May 16 at 4:29

Nikolai Shevchenko

7,6278 gold badges36 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tim May 17 at 4:36

Thank you. This isn't something I can fix by updating the pom.xml file is it?

Nikolai Shevchenko May 17 at 14:05

@Tim it isn't. It can be probably fixed in your Dockerfile (if you have any) or similar config where OS image is specified

Collectives™ on Stack Overflow

Mitigating a libsoup vulnerability in a Java 17 app

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related