WIDOCO currently inherits critical vulnerable dependencies through OWL2VOWL 0.3.5. #825

Summary

WIDOCO currently inherits critical vulnerable dependencies through OWL2VOWL 0.3.5.

Checked on WIDOCO master, commit 338e94dad4a70ad697f1d2e869738029877168bf.

Context

Upgrading OWL2VOWL does not currently appear to resolve the issue:

• WIDOCO uses OWL2VOWL 0.3.5.
• Latest OWL2VOWL release found: 0.3.7.
• OWL2VOWL 0.3.7 still declares these dependencies.
• Current OWL2VOWL master also still declares these dependencies.
• Previous OWL2VOWL dependency-security issues/PRs appear mostly unresolved.

References:

• https://github.com/VisualDataWeb/OWL2VOWL/releases
• OWASP checks VisualDataWeb/OWL2VOWL#68
• Safer - Compatible Updates to Fix Vulnerable Dependencies VisualDataWeb/OWL2VOWL#73
• https://nvd.nist.gov/vuln/detail/CVE-2015-7501
• https://nvd.nist.gov/vuln/detail/CVE-2019-10202

Suggested next steps

Possible remediation options include:

• Review whether collections-generic is actually needed. It appears unused from source and bytecode inspection, but this should be confirmed with build and conversion tests.
• Evaluate whether WIDOCO can exclude unused vulnerable transitive dependencies from OWL2VOWL.
• Evaluate replacing or patching the obsolete Codehaus Jackson usage in OWL2VOWL.
• If upstream OWL2VOWL remains inactive, consider consuming a patched OWL2VOWL fork through JitPack.
• Rebuild the shaded WIDOCO JAR and scan the extracted artifact after any dependency changes.