CVE-2024-38999 requirejs v2.3.6 was discovered to contain a prototype pollution (#118)

Co-authored-by: Valery Kharseko <[email protected]>

Author: maximthomas

legal/THIRDPARTYREADME.txt

@@ -1341,8 +1341,8 @@ Copyright: Tim Wood, Iskren Chernev, Moment.js
 Version: lodash-3.10.1-min.js
 Copyright: Copyright 2012-2015 The Dojo Foundation <http://dojofoundation.org/>
 
-Version: requirejs-2.1.14-min.js
-Copyright: Copyright (c) 2010-2014, The Dojo Foundation
+Version: requirejs-2.3.7-min.js
+Copyright: Copyright (c) 2010-2024, The Dojo Foundation
 
 Version: spin-2.0.1-min.js
 Copyright: Copyright (c) 2011-2014 Felix Gnass

openidm-ui/openidm-ui-admin/src/license/THIRD-PARTY.properties

@@ -36,7 +36,7 @@ org.forgerock.commons.ui.libs--moment--2.8.1=MIT
 org.forgerock.commons.ui.libs--moment-timezone-with-data--0.5.4=MIT
 org.forgerock.commons.ui.libs--qunit--1.15.0=MIT
 org.forgerock.commons.ui.libs--r--2.1.10=MIT
-org.forgerock.commons.ui.libs--requirejs--2.1.14=MIT
+org.forgerock.commons.ui.libs--requirejs--2.3.7=MIT
 org.forgerock.commons.ui.libs--sinon--1.15.4=BSD
 org.forgerock.commons.ui.libs--spin--2.0.1=MIT
 org.forgerock.commons.ui.libs--titatoggle--1.2.6=BSD

openidm-ui/openidm-ui-common/src/main/resources/index.html

@@ -28,6 +28,6 @@
         deps : ['main']
     };
 </script>
-<script data-main="main" src="libs/requirejs-2.1.14-min.js"></script>
+<script data-main="main" src="libs/requirejs-2.3.7-min.js"></script>
 </body>
 </html>

openidm-ui/openidm-ui-common/src/test/qunit/index.html

@@ -27,7 +27,7 @@
     <script src="../www/libs/qunit-2.20.1.js"></script>
     <script>QUnit.config.autostart = false;</script>
 
-    <script data-main="testRunner" src="../www/libs/requirejs-2.1.14-min.js"></script>
+    <script data-main="testRunner" src="../www/libs/requirejs-2.3.7-min.js"></script>
     <script>define('qunit', function () { return QUnit; });</script>
 </body>
 </html>

openidm-ui/openidm-ui-enduser/src/license/THIRD-PARTY.properties

@@ -34,7 +34,7 @@ org.forgerock.commons.ui.libs--jsoneditor--0.7.9=MIT
 org.forgerock.commons.ui.libs--moment--2.8.1=MIT
 org.forgerock.commons.ui.libs--qunit--1.15.0=MIT
 org.forgerock.commons.ui.libs--r--2.1.10=MIT
-org.forgerock.commons.ui.libs--requirejs--2.1.14=MIT
+org.forgerock.commons.ui.libs--requirejs--2.3.7=MIT
 org.forgerock.commons.ui.libs--sinon--1.15.4=BSD
 org.forgerock.commons.ui.libs--spin--2.0.1=MIT
 org.forgerock.commons.ui.libs--titatoggle--1.2.6=BSD

openidm-ui/pom.xml

@@ -21,6 +21,7 @@
   ~ with the fields enclosed by brackets [] replaced by
   ~ your own identifying information:
   ~ "Portions Copyrighted [year] [name of copyright owner]"
+  ~ Portions Copyrighted 2019-2025 3A Systems LLC.
   -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
@@ -576,7 +577,7 @@
 						<artifactItem>
 							<groupId>org.openidentityplatform.commons.ui.libs</groupId>
 							<artifactId>requirejs</artifactId>
-							<version>2.1.14</version>
+							<version>2.3.7</version>
 							<classifier>min</classifier>
 							<packaging>js</packaging>
 							<downloadUrl>https://cdnjs.cloudflare.com/ajax/libs/require.js/{version}/require.{classifier}.{packaging}</downloadUrl>

openidm-zip/src/license/THIRD-PARTY.properties

@@ -18,7 +18,7 @@ org.forgerock.commons.ui.libs--ldapjs-filter--2253=MIT
 org.forgerock.commons.ui.libs--moment--2.8.1=MIT
 org.forgerock.commons.ui.libs--moment-timezone-with-data--0.5.4=MIT
 org.forgerock.commons.ui.libs--qunit--1.15.0=MIT
-org.forgerock.commons.ui.libs--requirejs--2.1.14=MIT
+org.forgerock.commons.ui.libs--requirejs--2.3.7=MIT
 org.forgerock.commons.ui.libs--sinon--1.12.2=BSD
 org.forgerock.commons.ui.libs--spin--2.0.1=MIT
 org.forgerock.commons.ui.libs--xdate--0.8=MIT

pom.xml

@@ -413,7 +413,7 @@
             <dependency>
                 <groupId>org.openidentityplatform</groupId>
                 <artifactId>openicf</artifactId>
-                <version>1.8.0</version>
+                <version>1.8.1</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>