Vulnerability in Apache Lucene 8.9

[siakhooi]

Hi, sorry if I have raised the issue at wrong place.

There is a vulnerability report on apache lucene 8.9 and request us to upgrade to 8.10.

the report show that we are using redhat.java plugin that contains a file called
org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar
that contains lucene-*-5.5.5.jar

We have tried to use latest version of redhat.java 1.6 and get the same result. (still lucene 5.5)

Anyway that we can fix this vulnerability?

Path:
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-analyzers-common-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-backward-codecs-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-core-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-highlighter-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-join-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-memory-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-queries-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-queryparser-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-sandbox-5.5.5.jar

[siakhooi]

related url:
opensearch-project/OpenSearch#687
https://issues.apache.org/jira/browse/LUCENE-9981

[rgrunber]

I see you also posted this at eclipse-jdtls/eclipse.jdt.ls#2085, which was addressed as part of the 1.7.0 release of vscode-java. We basically updated m2e (the plugin that handles Maven integration) to 2.x, which removed its dependence on Lucene entirely.

[siakhooi]

thank you!