A configuration for the maven-enforcer-plugin that blocks CVE vulnerable versions of common Java libraries (e.g., Log4j, Apache Commons Text, Spring Framework, Spring Boot, etc.)

pom.xml

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-enforcer-plugin</artifactId>
  <executions>
    <execution>
      <id>ban-CVE-dependencies</id>
      <goals>
        <goal>enforce</goal>
      </goals>
      <configuration>
        <rules>
          <bannedDependencies>
            <excludes>
              <!-- CVE-2019-17571 -->
              <exclude>log4j:log4j</exclude>
              <!-- CVE-2022-42889 -->
              <exclude>org.apache.commons:commons-text:(,1.10.0)</exclude>
              <!-- CVE-2021-44228, CVE-2021-44832, CVE-2021-45046, CVE-2021-45105 -->
              <exclude>org.apache.logging.log4j:log4j-core:(,2.17.1)</exclude>
              <!-- CVE-2022-22965, CVE-2022-22968, CVE-2023-20861 -->
              <exclude>org.springframework:spring-core:(,5.3.26),[6.0.0,6.0.7)</exclude>
              <!-- CVE-2023-20883 -->
              <exclude>org.springframework.boot:spring-boot:(,2.7.12),[3.0.0,3.0.7)</exclude>
            </excludes>
          </bannedDependencies>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>