fix(register): nacos的tomcat安全漏洞升级

Closes #IBCXL6
pig-mesh · Dec 23, 2024 · e87d4ba · e87d4ba
1 parent c0579dd
commit e87d4ba
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/pig-register/pom.xml b/pig-register/pom.xml
@@ -29,6 +29,7 @@
 
     <properties>
         <nacos.version>2.4.3</nacos.version>
+        <tomcat.version>9.0.93</tomcat.version>
         <spring-boot.version>2.7.18</spring-boot.version>
         <spring-boot-admin.version>2.7.16</spring-boot-admin.version>
     </properties>
@@ -94,6 +95,27 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!--  覆盖nacos tomcat version 避免CVE-2024-24549-->
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-websocket</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-core</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-el</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.tomcat</groupId>
+                <artifactId>tomcat-annotations-api</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>