vertx-core jar quarantined due to incorrect CVE vulnerability by Sonatype about vert.x HOT 7 CLOSED

@vietj

You are correct. I added the wrong CVE.

Please see screenshot below

from vert.x.

thanks @yeikel

from vert.x.

Hi, I am assuming you are using Sonatype tools ?

the CVE assignment is actually incorrect, can you get in touch with me personally ? @himanshumps

from vert.x.

I took the freedom to rename this to a more correct title since this is misleading and affecting Vert.x reputation.

from vert.x.

Can you provide more details of the quarantine, like screenshots @himanshumps

from vert.x.

thanks for the the info

from vert.x.

This issue is preventing us from pulling some Quarkus components as well. For example :

    <dependency>
            <groupId>io.quarkus</groupId>
            <artifactId>quarkus-rest-client-reactive-jackson</artifactId>
            <version>3.7.1</version>
        </dependency>

     <dependency>
            <groupId>io.quarkus</groupId>
            <artifactId>quarkus-virtual-threads</artifactId>
            <version>3.7.1</version>
        </dependency>

There are probably other components impacted as well as they have vertx-core as a transitive dependency

from vert.x.