Repository navigation
CVE-2020-11023 in KC due to jquery #52459
Replies: 1 comment
|
jQuery is genuinely there, so the presence half is not a false positive — but the version difference you are inferring between releases is not in the source. I compared the three tags you named.
That declared version is also not one CVE-2020-11023 applies to: the fix landed in jQuery 3.5.0, and 3.7.1 is well past it. And nothing jQuery-shaped is committed to the repository at all — the tree at 25.0.6 is 12,597 entries, not truncated, with no path matching jquery. So whatever your scan matched came out of the build, not out of git. Which is why I would push this back at the scanner rather than at Keycloak. Ask NexusIQ for the exact artifact path it flagged and the version string it read inside it. A Worth confirming one thing while you are at it: that 23.0.7 and 26.7.3 were scanned against the same artifact type as 25.0.6. A distribution zip, a container image and a source build do not present the same file set to a scanner, and "clean on the others" is only meaningful if all three were the same kind of thing. |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I am using NexusIQ for vulns scanning.
This CVE is reported by NexusIQ on KC 25.0.6 but not on KC 23.0.7 and KC 26.5.7.
Even the latest KC version eg 26.7.3 doesn't contain this CVE.
Is there a problem in KC 25.0.6 delivery ? why jQuery is present in this versions and not on the other ones ?
Is jQuery really used in this version ? Or is it a NexusIQ false positive ?
Best Regards.
All reactions