Sonarqube is throwing undertow-core vulnerability finding. How to resolve

Sonarqube is throwing undertow-core vulnerability finding. How to resolve.

   "textRange": {
      "startLine": 1,
      "endLine": 1,
      "startOffset": 0,
      "endOffset": 38
    },
    "flows": [],
    "status": "OPEN",
    "message": "Filename: test-0.0.1-SNAPSHOT.jar: undertow-core-2.0.29.Final.jar 
| Reference: CVE-2020-1745 | CVSS Score: 9.8 | Category: CWE-200 | A file inclusion 
vulnerability was found 
in the AJP connector enabled with a default AJP configuration port of 8009 in 
Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, 
unauthenticated attacker could exploit this vulnerability to read web application files 
from a vulnerable server. In instances where the vulnerable server allows file uploads, 
an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file 
types and trigger this vulnerability to gain remote code execution.",

Undertow isn't available on the pom, as it is a child of another dependency (spring-boot-starter-undertow, which is updated to the latest version of 2.3.3.RELEASE). Is there a way I can make spring-boot-starter have a specific version of undertow?

[INFO] +- org.springframework.boot:spring-boot-starter-undertow:jar:2.3.3.RELEASE:compile
[INFO] |  +- io.undertow:undertow-core:jar:2.0.29.Final:compile
[INFO] |  |  +- org.jboss.xnio:xnio-api:jar:3.3.8.Final:compile
[INFO] |  |  \- org.jboss.xnio:xnio-nio:jar:3.3.8.Final:runtime

[INFO] |  +- io.undertow:undertow-servlet:jar:2.0.29.Final:compile
[INFO] |  +- io.undertow:undertow-websockets-jsr:jar:2.0.29.Final:compile
[INFO] |  |  \- org.jboss.spec.javax.websocket:jboss-websocket-api_1.1_spec:jar:1.1.4.Final:compile
[INFO] |  +- jakarta.servlet:jakarta.servlet-api:jar:4.0.3:compile
[INFO] |  \- org.glassfish:jakarta.el:jar:3.0.3:compile

If you need a specific version of Undertow, just include it in your pom.xml:

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.0.30.Final</version>
</dependency>

By doing so, you will override any other versions that you might be getting via your other dependencies — including Spring's.

If the version you need is already included in some other package's dependencies and you'd rather have Spring use that one (instead of manually overriding every Undertow dependency in your pom), you may try to exclude just the one provided by the starter:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
    <version>2.3.3.RELEASE</version> <!-- already includes undertow 2.0.30 -->
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
  <version>2.3.3.RELEASE</version>
  <exclusions>
    <exclusion>
      <groupId>io.undertow</groupId>
      <artifactId>undertow-core</artifactId>
    </exclusion>
  </exclusions>
</dependency>

If you do the above, Spring will pick the undertow-core version provided by spring-boot-actuator instead of the one provided by spring-boot-starter-undertow.