Update groovy-all to remove the vulnerability

[Oliver2421]

Hi, @ahitch, I stumbled upon a vulnerability introduced by package groovy-all-2.4.17.jar:

Issue Description

When I build the project, I notice that package groovy-all-2.4.17 with a vulnerability (CVE-2020-17521) will be downloaded in the arctic-sea-master\iceland\statistics\core module. I know that this project downloads and loads groovy-all in EmbeddedElasticsearch.init() by classLoader at run time.

Why is the project referencing this third-party library in a dynamically loaded manner instead of using maven for dependency management?

Is it possible to update groovy-all to remove the vulnerability?

Suggested Solution

Maybe you can try to upgrade groovy-all to 2.4.21.

Note:
_ groovy-all@2.4.21_ has fixed all vulnerabilities.
Of course, you are welcome to share other ways to resolve the issue.

Thank you for your attention to this issue and welcome to share other ways to resolve the issue.

Best regards,
^_^

[AbhayXplorer]

Hello I’m interested in working on this issue as part of my open-source contribution.
Could you please assign this issue to me?