Mailing-List: contact dev-help@ant.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Ant Developers List" <dev@ant.apache.org>
From: Stefan Bodewig <bodewig@apache.org>
To: dev@ant.apache.org
Subject: Re: Ivy - No more support for commons-httpclient 2.x in runtime classpath?
References: <5fa6472c-075e-5620-3f5f-ba58bddd4269@apache.org>
Date: Mon, 24 Jul 2017 08:13:51 +0200
In-Reply-To: <5fa6472c-075e-5620-3f5f-ba58bddd4269@apache.org> (Jaikiran Pai's
	message of "Mon, 24 Jul 2017 10:54:36 +0530")
Message-ID: <877eyy2wgw.fsf@v45346.1blu.de>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
archived-at: Mon, 24 Jul 2017 06:13:57 -0000

On 2017-07-24, Jaikiran Pai wrote:

> Ivy currently uses commons-httpclient for dealing with HTTP
> repositories. This is an internal implementation detail of Ivy. The
> way it's implemented, it allows the user to use a version of their
> choice, of this library, by placing them in the runtime classpath
> (similar to some other libraries we use). The implementation
> internally checks for the presence of 2.x as well as 3.x version of
> library to decide which version to use at _runtime_ .

Let me point out that even 3.x has long reached end of life. It's
successor fixed CVE-2012-5783[1] with 4.2.3 but there hasn't been any
3.x release that has fixed it AFAIK.

Stefan

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org