OSS scan findings for ACS AEM Commons 6.17.4 in Adobe Experience Manager as a Cloud Service
This article explains how to address open source security scan vulnerabilities reported in the ACS AEM Commons 6.17.4 dependency when used with Adobe Experience Manager as a Cloud Service. It outlines steps to remediate, assess, or document these findings for compliance and security teams.
Description description
Environment
- Adobe Experience Manager as a Cloud Service
- ACS AEM Commons dependency:
com.adobe.acs:acs-aem-commons-all:zip:cloud:6.17.4
Issue/Symptoms
- An OSS scanner, such as Sonatype, reports findings associated with the ACS AEM Commons dependency.
- The scan lists
sonatype-2016-0064,CVE-2024-21490, orCVE-2022-25844. - The findings appear during dependency checks in project files or CI/CD security scans and require review by security or compliance teams.
Cause
The scanner associates the findings with the ACS AEM Commons package, but the package coordinate alone doesn’t identify the nested library and version responsible for each finding. CVE-2024-21490 and CVE-2022-25844 describe AngularJS-related ReDoS issues; verify that the dependency tree contains an affected AngularJS package and version before attributing either CVE to this ACS AEM Commons package. The public Sonatype lookup did not return a record for sonatype-2016-0064; verify that identifier against the full scanner report.
Resolution resolution
Follow the steps below to resolve the issue:
- Review the ACS AEM Commons release notes and verify whether a version newer than
6.17.4is available that addresses the reported CVEs. - If a newer release remediates the reported vulnerabilities, update the project dependency to the latest compatible version and redeploy the application.
- Review each reported CVE and determine whether it affects any ACS AEM Commons features used in your implementation.
- If a reported vulnerability is associated with a feature that is not used in your implementation, document the assessment and share it with the appropriate security or compliance stakeholders.
- If your organization’s security policy permits it, configure the OSS scanning tool to suppress the finding or accept the risk for vulnerabilities that are not exploitable in your environment.
- If no remediation is available and the vulnerability is relevant to your implementation, submit an issue to the ACS AEM Commons GitHub project and include the relevant CVE details.
- After applying any changes, rerun the OSS scan and verify that the reported vulnerabilities are either remediated or appropriately documented.