CVE-2025-7962: Security Vulnerability for webservices-rt #472

Signed-off-by: Jorge Bescos Gascon <jorge.bescos.gascon@oracle.com>

Author: jbescos

jaxws-ri/boms/bom-ext/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2012, 2024 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2012, 2025 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
     terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -36,8 +36,8 @@
         <asm.version>9.7</asm.version>
         <eclipselink.version>4.0.3</eclipselink.version>
         <junit.version>4.13.2</junit.version>
-        <mail-api.version>2.1.3</mail-api.version>
-        <angus-mail.version>2.0.3</angus-mail.version>
+        <mail-api.version>2.1.5</mail-api.version>
+        <angus-mail.version>2.0.5</angus-mail.version>
         <servlet-api.version>6.1.0</servlet-api.version>
     </properties>
 

jaxws-ri/boms/bom/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2012, 2024 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2012, 2025 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
     terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -45,8 +45,8 @@
         <streambuffer.version>2.1.0</streambuffer.version>
         <woodstox-core.version>7.0.0</woodstox-core.version>
         <stax2-api.version>4.2.2</stax2-api.version>
-        <activation-api.version>2.1.3</activation-api.version>
-        <angus-activation.version>2.0.2</angus-activation.version>
+        <activation-api.version>2.1.4</activation-api.version>
+        <angus-activation.version>2.0.3</angus-activation.version>
         <jakarta.annotation-api.version>3.0.0</jakarta.annotation-api.version>
     </properties>
 

jaxws-ri/extras/jaxws-maven-plugin/pom.xml

@@ -3,7 +3,7 @@
 
     DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 
-    Copyright (c) 2006, 2024 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2006, 2025 Oracle and/or its affiliates. All rights reserved.
 
     Oracle licenses this file to You under the Apache License, Version 2.0
     (the "License"); you may not use this file except in compliance with
@@ -287,7 +287,7 @@
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
-                    <version>8.4.0</version>
+                    <version>12.1.8</version>
                     <configuration>
                         <failBuildOnCVSS>8</failBuildOnCVSS>
                         <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>

jaxws-ri/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2012, 2024 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2012, 2025 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
     terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -416,7 +416,7 @@
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
-                    <version>8.4.0</version>
+                    <version>12.1.8</version>
                     <configuration>
                         <failBuildOnCVSS>7</failBuildOnCVSS>
                         <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>

jaxws-ri/runtime/policy/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 1997, 2024 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 1997, 2025 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
     terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -410,7 +410,7 @@
             <plugin>
                 <groupId>org.owasp</groupId>
                 <artifactId>dependency-check-maven</artifactId>
-                <version>8.4.0</version>
+                <version>12.1.8</version>
                 <configuration>
                     <failBuildOnCVSS>7</failBuildOnCVSS>
                     <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>