diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
index 0b19a955a5d..dc3ffdd86d4 100644
--- a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
+++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
@@ -4,8 +4,8 @@
Bintray and JCenter are shutting down on February 1st, 2022.
-Relying upon repositories that are deprecated or slated to be shutdown can have unintended consequences;
-for example, artifacts being resolved from different artifact server or total breakage of the CI build.
When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge. Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql index 5f6a0834428..936da80a9d9 100644 --- a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql +++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql @@ -1,6 +1,6 @@ /** * @name Depending upon JCenter/Bintray as an artifact repository - * @description JCenter & Bintray are deprecated + * @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack. * @kind problem * @problem.severity error * @precision very-high