Vulnerable jar velocity-1.7.jar in SmartClient_v121p_2024-10-20_Enterprise

[cs2000xli]

There is security vulnerability CVE-2020-13936 in velocity-1.7.jar.
1. Does SmartClient venerable? If this is not vulnerable, can you explain why?
2. According to IBM security policy, we must remove the vulnerable jar even the product is not vulnerable. Is there a new version of SmartClient without this vulnerable jar?

[b2bidev]

I need the answer urgently. Please reply

[claudiobosticco]

Hello, see this post: https://forums.smartclient.com/forum...-vulnerability