I am developing plugin for JIRA on premise version 10.x.
I am getting the security vulnerability BDSA-2021-0710 CVE-2020-13936.
This is coming from apache velocity 1.6.4 - atlassian-36.
Below is dependency tree :
[INFO] +- com.atlassian.jira:jira-api:jar:10.0.0:provided
[INFO] | +- com.atlassian.annotations:atlassian-annotations:jar:5.0.1:provided (version managed from 5.0.1)
[INFO] | +- com.atlassian.ofbiz:entityengine-share:jar:4.0.0:provided (version managed from 4.0.0)
[INFO] | | \- xerces:xercesImpl:jar:2.12.2:provided (version managed from 2.12.2)
[INFO] | | \- xml-apis:xml-apis:jar:1.4.01:provided (version managed from 1.4.01)
[INFO] | +- com.atlassian.ofbiz:entityengine:jar:4.0.0:provided (version managed from 4.0.0)
[INFO] | | \- jakarta.transaction:jakarta.transaction-api:jar:1.3.3:provided (version managed from 1.3.3)
[INFO] | +- com.atlassian.collectors:atlassian-collectors-util:jar:1.1:provided (version managed from 1.1)
[INFO] | +- opensymphony:webwork:jar:1.4-atlassian-31:provided (version managed from 1.4-atlassian-31)
[INFO] | | \- com.atlassian.html:atlassian-html-encoder:jar:1.5:provided (version managed from 1.4)
[INFO] | +- webwork:pell-multipart-request:jar:1.31.0:provided
[INFO] | +- com.atlassian.core:atlassian-core-logging:jar:9.0.0:provided (version managed from 9.0.0)
[INFO] | +- com.atlassian.core:atlassian-core-user:jar:9.0.0:provided (version managed from 9.0.0)
[INFO] | | +- com.atlassian.core:atlassian-core:jar:9.0.0:provided (version managed from 9.0.0)
[INFO] | | | \- (opensymphony:propertyset:jar:1.5:provided - omitted for duplicate)
[INFO] | | \- (opensymphony:propertyset:jar:1.5:provided - omitted for duplicate)
[INFO] | +- com.atlassian.core:atlassian-core-thumbnail:jar:9.0.0:provided (version managed from 9.0.0)
[INFO] | | +- (com.atlassian.core:atlassian-core:jar:9.0.0:provided - version managed from 9.0.0; omitted for duplicate)
[INFO] | | \- com.twelvemonkeys.imageio:imageio-core:jar:3.8.2:provided
[INFO] | | +- com.twelvemonkeys.common:common-lang:jar:3.8.2:provided
[INFO] | | +- com.twelvemonkeys.common:common-io:jar:3.8.2:provided
[INFO] | | | \- (com.twelvemonkeys.common:common-lang:jar:3.8.2:provided - omitted for duplicate)
[INFO] | | \- com.twelvemonkeys.common:common-image:jar:3.8.2:provided
[INFO] | | +- (com.twelvemonkeys.common:common-lang:jar:3.8.2:provided - omitted for duplicate)
[INFO] | | \- (com.twelvemonkeys.common:common-io:jar:3.8.2:provided - omitted for duplicate)
[INFO] | +- com.atlassian.extras:atlassian-extras:jar:3.4.6:provided (version managed from 3.4.6)
[INFO] | | +- (commons-codec:commons-codec:jar:1.16.1:provided - version managed from 1.11; omitted for duplicate)
[INFO] | | \- com.atlassian.extras:atlassian-extras-key-manager:jar:3.4.6:provided (version managed from 3.4.6)
[INFO] | | +- com.atlassian.extras:atlassian-extras-common:jar:3.4.6:provided (version managed from 3.4.6)
[INFO] | | | \- com.atlassian.extras:atlassian-extras-api:jar:3.4.6:provided (version managed from 3.4.6)
[INFO] | | \- (commons-codec:commons-codec:jar:1.16.1:provided - version managed from 1.11; omitted for duplicate)
[INFO] | +- com.atlassian.velocity:atlassian-velocity:jar:1.4:provided (version managed from 1.4)
[INFO] | | +- (com.atlassian.core:atlassian-core:jar:9.0.0:provided - version managed from 4.6.0; omitted for duplicate)
[INFO] | | +- (org.apache.commons:commons-lang3:jar:3.14.0:provided - version managed from 3.12.0; omitted for duplicate)
[INFO] | | +- org.apache.commons:commons-text:jar:1.11.0:provided (version managed from 1.9)
[INFO] | | | \- (org.apache.commons:commons-lang3:jar:3.14.0:provided - version managed from 3.13.0; omitted for duplicate)
[INFO] | | +- (org.apache.velocity:velocity:jar:1.6.4-atlassian-36:provided - version managed from 1.6.4-atlassian-7; omitted for duplicate)
[INFO] | | \- opensymphony:oscore:jar:2.2.7-atlassian-1:provided
[INFO] | +- org.apache.velocity:velocity:jar:1.6.4-atlassian-36:provided (version managed from 1.6.4-atlassian-36)
[INFO] | | +- commons-collections:commons-collections:jar:3.2.2:provided (version managed from 3.2.2)
[INFO] | | +- (org.apache.commons:commons-lang3:jar:3.14.0:provided - version managed from 3.12.0; omitted for duplicate)
[INFO] | | +- (org.apache.commons:commons-text:jar:1.11.0:provided - version managed from 1.10.0; omitted for duplicate)
[INFO] | | \- (oro:oro:jar:2.0.8:provided - version managed from 2.0.8; omitted for duplicate)
