CVE-2022-45688 in org.json:json:20220924

[sourabhsparkala]

Hello All,

Please find that CVE-2022-45688 is being reported for org.json:json:20220924

Even though the description in the above link shows a different CPE mapping hutool:5.8.10

The issue-comment clarifies that the correct OSS lib is org.json:json:20220924

Hence requesting you to update

+- com.sap.cloud.security:env:jar:2.13.6:compile
|  +- org.json:json:jar:20220924:compile

Thanks
Sourabh

[liga-oz]

Hi @sourabhsparkala,

We are not affected by this CVE https://github.com/SAP/cloud-security-xsuaa-integration/blob/main-2.x/etc/suppression.xml#L7

We keep all our dependencies always up to date, therefore it will be update in the next release anyway.

Kind Regards,
Liga