Fix CVE dependency issue(Dependency org.apache.commons:commons-compress, leading to CVE problem)

[CVEDetect]

Hi, In /meecrowave-maven-plugin，there is a dependency org.apache.commons:commons-compress:1.18 that calls the risk method.

CVE-2019-12402

The scope of this CVE affected version is [1.15,1.19)

After further analysis, in this project, the main Api called is org.apache.commons.compress.archivers.zip.NioZipEncoding: encode(java.lang.String)Ljava.nio.ByteBuffer

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

CVE Bug Invocation Path : 
org.apache.meecrowave.maven.MeecrowaveBundleMojo: execute()V .m2/repository/org/apache/maven/maven-model-builder/3.6.3/maven-model-builder-3.6.3.jar
org.apache.meecrowave.maven.MeecrowaveBundleMojo: tarGz(org.apache.commons.compress.archivers.tar.TarArchiveOutputStream,java.io.File,java.nio.file.Path)V .m2/repository/org/apache/maven/maven-model-builder/3.6.3/maven-model-builder-3.6.3.jar
org.apache.commons.compress.archivers.tar.TarArchiveOutputStream: putArchiveEntry(org.apache.commons.compress.archivers.ArchiveEntry)V .m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.tar.TarArchiveOutputStream: handleLongName(org.apache.commons.compress.archivers.tar.TarArchiveEntry,java.lang.String,java.util.Map,java.lang.String,byte,java.lang.String)Z /ho.m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.NioZipEncoding: encode(java.lang.String)Ljava.nio.ByteBuffer;

CVE-2021-36090

The scope of this CVE affected version is [0,1.31)

After further analysis, in this project, the main Api called is org.apache.commons.compress.archivers.zip.AsiExtraField: parseFromLocalFileData(byte[],int,int)V

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 8

CVE Bug Invocation Path : 
org.apache.meecrowave.maven.MeecrowaveBundleMojo: execute()V .m2/repository/org/apache/maven/maven-model-builder/3.6.3/maven-model-builder-3.6.3.jar
org.apache.meecrowave.maven.MeecrowaveBundleMojo: zip(org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream,java.io.File,java.nio.file.Path)V .m2/repository/org/apache/maven/maven-model-builder/3.6.3/maven-model-builder-3.6.3.jar
org.apache.commons.compress.archivers.jar.JarArchiveOutputStream: putArchiveEntry(org.apache.commons.compress.archivers.ArchiveEntry)V .m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.ZipArchiveEntry: addAsFirstExtraField(org.apache.commons.compress.archivers.zip.ZipExtraField)V /.m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.ZipArchiveEntry: setExtra()V .m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.ZipArchiveEntry: setExtra(byte[])V .m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.ExtraFieldUtils: parse(byte[],boolean,org.apache.commons.compress.archivers.zip.ExtraFieldUtils$UnparseableExtraField)[Lorg.apache.commons.compress.archivers.zip.ZipExtraField; .m2/repository/org/apache/commons/commons-compress/1.18/commons-compress-1.18.jar
org.apache.commons.compress.archivers.zip.AsiExtraField: parseFromLocalFileData(byte[],int,int)V

Dependency tree--

[INFO] org.apache.meecrowave:meecrowave-maven-plugin:maven-plugin:1.2.16-SNAPSHOT
[INFO] +- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-model:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-artifact:jar:3.6.3:compile
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
[INFO] |  \- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
[INFO] +- org.apache.maven:maven-core:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-settings:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-settings-builder:jar:3.6.3:compile
[INFO] |  |  \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
[INFO] |  |     \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
[INFO] |  +- org.apache.maven:maven-builder-support:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-repository-metadata:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-model-builder:jar:3.6.3:compile
[INFO] |  +- org.apache.maven:maven-resolver-provider:jar:3.6.3:compile
[INFO] |  +- org.apache.maven.resolver:maven-resolver-impl:jar:1.4.1:compile
[INFO] |  +- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
[INFO] |  +- org.apache.maven.resolver:maven-resolver-spi:jar:1.4.1:compile
[INFO] |  +- org.apache.maven.resolver:maven-resolver-util:jar:1.4.1:compile
[INFO] |  +- org.apache.maven.shared:maven-shared-utils:jar:3.2.1:compile
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
[INFO] |  +- com.google.inject:guice:jar:no_aop:4.2.1:compile
[INFO] |  |  +- aopalliance:aopalliance:jar:1.0:compile
[INFO] |  |  \- com.google.guava:guava:jar:25.1-android:compile
[INFO] |  |     +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] |  |     +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
[INFO] |  |     +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
[INFO] |  |     +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
[INFO] |  |     \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
[INFO] |  +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
[INFO] |  \- org.apache.commons:commons-lang3:jar:3.8.1:compile
[INFO] +- org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.3:compile
[INFO] +- org.apache.maven.shared:maven-dependency-tree:jar:3.0.1:compile
[INFO] |  \- org.eclipse.aether:aether-util:jar:0.9.0.M2:compile
[INFO] +- org.apache.meecrowave:meecrowave-core:jar:1.2.16-SNAPSHOT:compile
[INFO] |  +- org.apache.meecrowave:meecrowave-specs-api:jar:1.2.16-SNAPSHOT:compile
[INFO] |  +- org.apache.tomcat:tomcat-jaspic-api:jar:9.0.70:compile
[INFO] |  +- org.apache.xbean:xbean-finder-shaded:jar:4.20:compile
[INFO] |  +- org.apache.xbean:xbean-asm9-shaded:jar:4.20:compile
[INFO] |  +- org.apache.xbean:xbean-reflect:jar:4.20:compile
[INFO] |  +- org.apache.openwebbeans:openwebbeans-spi:jar:2.0.27:compile
[INFO] |  +- org.apache.openwebbeans:openwebbeans-web:jar:2.0.27:compile
[INFO] |  |  +- org.apache.openwebbeans:openwebbeans-impl:jar:2.0.27:compile
[INFO] |  |  \- org.apache.openwebbeans:openwebbeans-el22:jar:2.0.27:compile
[INFO] |  +- org.apache.tomcat:tomcat-catalina:jar:9.0.70:compile
[INFO] |  |  +- org.apache.tomcat:tomcat-juli:jar:9.0.70:compile
[INFO] |  |  +- org.apache.tomcat:tomcat-api:jar:9.0.70:compile
[INFO] |  |  +- org.apache.tomcat:tomcat-jni:jar:9.0.70:compile
[INFO] |  |  +- org.apache.tomcat:tomcat-coyote:jar:9.0.70:compile
[INFO] |  |  +- org.apache.tomcat:tomcat-util:jar:9.0.70:compile
[INFO] |  |  \- org.apache.tomcat:tomcat-util-scan:jar:9.0.70:compile
[INFO] |  +- org.apache.cxf:cxf-rt-frontend-jaxrs:jar:3.5.5:compile
[INFO] |  |  +- org.apache.cxf:cxf-core:jar:3.5.5:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-transports-http:jar:3.5.5:compile
[INFO] |  |  \- org.apache.cxf:cxf-rt-security:jar:3.5.5:compile
[INFO] |  +- org.apache.cxf:cxf-integration-cdi:jar:3.5.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-rs-client:jar:3.5.5:compile
[INFO] |  +- org.apache.johnzon:johnzon-jsonb:jar:1.2.19:compile
[INFO] |  |  \- org.apache.johnzon:johnzon-mapper:jar:1.2.19:compile
[INFO] |  |     \- org.apache.johnzon:johnzon-core:jar:1.2.19:compile
[INFO] |  +- org.apache.logging.log4j:log4j-api:jar:2.19.0:compile
[INFO] |  +- org.apache.logging.log4j:log4j-core:jar:2.19.0:compile
[INFO] |  \- org.apache.logging.log4j:log4j-jul:jar:2.19.0:compile
[INFO] +- org.apache.commons:commons-compress:jar:1.18:compile
[INFO] +- org.apache.maven.plugin-testing:maven-plugin-testing-harness:jar:3.3.0:test
[INFO] |  \- commons-io:commons-io:jar:2.2:compile
[INFO] +- org.codehaus.plexus:plexus-archiver:jar:4.2.3:test
[INFO] |  +- org.codehaus.plexus:plexus-io:jar:3.2.0:test
[INFO] |  +- org.iq80.snappy:snappy:jar:0.4:test
[INFO] |  \- org.tukaani:xz:jar:1.8:test
[INFO] +- org.apache.maven:maven-compat:jar:3.6.3:test
[INFO] |  +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
[INFO] |  \- org.apache.maven.wagon:wagon-provider-api:jar:3.3.4:test
[INFO] +- junit:junit:jar:4.13.2:test
[INFO] |  \- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO] +- org.apache.tomee:ziplock:jar:7.0.3:test
[INFO] \- org.slf4j:slf4j-simple:jar:1.7.32:test
[INFO]    \- org.slf4j:slf4j-api:jar:1.7.32:compile

Suggested solutions:

Update dependency version @struberg

Thank you very much.