title: jakarta.el library is flagged for security vulnaribility in NexusIQ [Quarkus]
body: <p>We use <code>quarkus-hibernate-validator</code> which pulls in <code>jakarta.el</code>. But recently all versions of <code>jakarta.el</code> is flagged by NexusIQ for a severe vulnaribility.</p>
  <p>[https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/][1]</p>
  <p>Details as follows:</p>
  <p>VULNERABILITY ISSUE
  sonatype-2020-1438
  ISSUE
  sonatype-2020-1438
  SEVERITY
  Sonatype CVSS 3:7.5
  CVE CVSS 2.0:0.0
  WEAKNESS
  Sonatype CWE:20
  SOURCE
  Sonatype Data Research
  CATEGORIES
  Data
  EXPLANATION
  The jakarta.el package contains an Improper Input Validation vulnerability. The LiteralExpression method in the ELParser class fails to properly identify literal expressions. Consequently, invalid expressions are evaluated as if they were valid. A remote attacker can exploit this vulnerability by crafting an EL expression containing a $ or # symbol followed by a backslash, /, and the payload. This will bypass current validations and cause the parser to evaluate the expression potentially allowing Remote Code Execution.</p>
  <p>DETECTION
  The application is vulnerable by using this component.</p>
  <p>RECOMMENDATION
  There is no non-vulnerable upgrade path for this component/package. We recommend investigating alternative components or a potential mitigating control.</p>
  <p>ROOT CAUSE
  jakarta.el-3.0.3.jbossorg-2.jarcom/sun/el/parser/ELParser.class( , )
  ADVISORIES
  Third Party:<a href="https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/" rel="nofollow noreferrer">https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/</a>
  CVSS DETAILS
  Sonatype CVSS 3:7.5</p>
  <p>Does Quarkus team have any recommendations on remediating this?</p>