Latest release v8.5.0 contains Okio package vulnerable to CWE-327

[juliankamil]

Latest release v8.5.0 contains Okio package vulnerable to CWE-327

[mediumTaj]

We didn't catch this with our appscan since we don't scan the Core repo. We need to add the core repo to our scans.

Also opened up an issue in the core to address
IBM/java-sdk-core#97

[stale]

This issue has been automatically marked as stale because it has had no recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Jennifer-Hadley]

Hi stale bot. This is still an issue, unfortunately the development team does not know who to contact to get appropriate support.

[mediumTaj]

@kevinkowa can you look at this for the major release?

[kevinkowa]

Alright!

[mediumTaj]

hmm strange that our appscan reports didnt pick this up. we should look into this as well cc @Mikemosca

[mediumTaj]

Talking to @jorge-ibm we should move to the latest version of the java sdk core for the major release.

we're now on okhttp3 v4.9 which uses okio v2.7 https://square.github.io/okhttp/changelog/#version-480

@kevinkowa

[stale]

This issue has been automatically marked as stale because it has had no recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[kevinkowa]

Fixed in the latest release