diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp index 0b19a955a5d..dc3ffdd86d4 100644 --- a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp +++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp @@ -4,8 +4,8 @@

Bintray and JCenter are shutting down on February 1st, 2022. -Relying upon repositories that are deprecated or slated to be shutdown can have unintended consequences; -for example, artifacts being resolved from different artifact server or total breakage of the CI build.

+Relying upon repositories that are deprecated or scheduled to be shutdown can have unintended consequences; +for example, artifacts being resolved from a different artifact server or a total failure of the CI build.

When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge. Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql index 5f6a0834428..936da80a9d9 100644 --- a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql +++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql @@ -1,6 +1,6 @@ /** * @name Depending upon JCenter/Bintray as an artifact repository - * @description JCenter & Bintray are deprecated + * @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack. * @kind problem * @problem.severity error * @precision very-high