Critical security issue

[mehtarachna]

Hello

We have integrated ACS AEM Commons version 6.9.2 into our codebase. However, our security scanning tool has flagged two critical security vulnerabilities associated with this version. In an effort to resolve these issues, we upgraded to ACS AEM Commons 6.10.0, hoping it would address the vulnerabilities, but unfortunately, the issues persist.

Please take a look at the screenshots I've attached for further details.

We would appreciate any guidance or assistance in addressing these issues.

Thanks,
Rachna

[davidjgonzalez]

I believe both of these vulnerable libraries are exposed via AEM artifacts - not ACS AEM Commons. ACS AEM Commons marks these are provided -- meaning something else is actually providing them (so those things could update these libraries to non-vulnerable versions).

Have you checked your AEM install to see if/what is exporting these artifacts/packages? Id so, what did you find?