Skip to:
When using OWASP Dependency Check for a project using JBehave 4.8.3, it reports 12 vulnerabilities in the xstream package: https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Axstream_project&cpe_product=cpe%3A%2F%3Axstream_project%3Axstream&cpe_version=cpe%3A%2F%3Axstream_project%3Axstream%3A1.4.15
Package com.thoughtworks.xstream is only used in the jbehave-rest module. Version 1.4.17 of xstream dependency removes the vulnerabilities. This is included in my forked project, commit:
com.thoughtworks.xstream
When using OWASP Dependency Check for a project using JBehave 4.8.3, it reports 12 vulnerabilities in the xstream package:
https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Axstream_project&cpe_product=cpe%3A%2F%3Axstream_project%3Axstream&cpe_version=cpe%3A%2F%3Axstream_project%3Axstream%3A1.4.15