Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: com.github.pmonks/unfurl 1.0.224-SNAPSHOT

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
args4j-2.0.26.jarpkg:maven/args4j/args4j@2.0.26 022
clj-http-3.13.0.jarpkg:maven/clj-http/clj-http@3.13.0 017
clojure-1.12.0.jarcpe:2.3:a:clojure:clojure:1.12.0:*:*:*:*:*:*:*pkg:maven/org.clojure/clojure@1.12.0 0Highest22
clojurescript-1.9.293.jarcpe:2.3:a:alex_project:alex:1.9.293:*:*:*:*:*:*:*
cpe:2.3:a:bloom_project:bloom:1.9.293:*:*:*:*:*:*:*		pkg:maven/org.clojure/clojurescript@1.9.293HIGH1Low266
closure-compiler-externs-v20160911.jarpkg:maven/com.google.javascript/closure-compiler-externs@v20160911 011
closure-compiler-unshaded-v20160911.jarpkg:maven/com.google.javascript/closure-compiler-unshaded@v20160911 026
codox-klipse-theme-0.0.1.jarpkg:maven/viebel/codox-klipse-theme@0.0.1 012
commons-codec-1.16.1.jarpkg:maven/commons-codec/commons-codec@1.16.1 0122
commons-io-2.16.1.jarcpe:2.3:a:apache:commons_io:2.16.1:*:*:*:*:*:*:*pkg:maven/commons-io/commons-io@2.16.1 0Highest124
commons-logging-1.2.jarpkg:maven/commons-logging/commons-logging@1.2 0116
core.specs.alpha-0.4.74.jarcpe:2.3:a:alex_project:alex:0.4.74:*:*:*:*:*:*:*pkg:maven/org.clojure/core.specs.alpha@0.4.74 0Low17
data.json-0.2.6.jarpkg:maven/org.clojure/data.json@0.2.6 021
google-closure-library-0.0-20160609-f42b4a24.jarcpe:2.3:a:google:closure_library:0.0.20160609.f42.b4:a24:*:*:*:*:*:*pkg:maven/org.clojure/google-closure-library@0.0-20160609-f42b4a24MEDIUM1Highest49
gson-2.2.4.jarcpe:2.3:a:google:gson:2.2.4:*:*:*:*:*:*:*pkg:maven/com.google.code.gson/gson@2.2.4HIGH1Highest40
guava-19.0.jarcpe:2.3:a:google:guava:19.0:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@19.0HIGH3Highest19
hickory-0.7.1.jarpkg:maven/hickory/hickory@0.7.1 012
httpasyncclient-4.1.5.jarcpe:2.3:a:apache:httpasyncclient:4.1.5:*:*:*:*:*:*:*pkg:maven/org.apache.httpcomponents/httpasyncclient@4.1.5 0Highest27
httpclient-4.5.14.jarcpe:2.3:a:apache:httpclient:4.5.14:*:*:*:*:*:*:*pkg:maven/org.apache.httpcomponents/httpclient@4.5.14 0Highest31
httpcore-4.4.16.jarpkg:maven/org.apache.httpcomponents/httpcore@4.4.16 031
httpcore-nio-4.4.15.jarpkg:maven/org.apache.httpcomponents/httpcore-nio@4.4.15 029
httpmime-4.5.14.jarpkg:maven/org.apache.httpcomponents/httpmime@4.5.14 029
jsinterop-annotations-1.0.0.jarpkg:maven/com.google.jsinterop/jsinterop-annotations@1.0.0 017
jsoup-1.18.1.jarcpe:2.3:a:jsoup:jsoup:1.18.1:*:*:*:*:*:*:*pkg:maven/org.jsoup/jsoup@1.18.1 0Highest44
jsr305-1.3.9.jarpkg:maven/com.google.code.findbugs/jsr305@1.3.9 015
potemkin-0.4.7.jarpkg:maven/potemkin/potemkin@0.4.7 017
protobuf-java-2.5.0.jarcpe:2.3:a:google:protobuf-java:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:protobuf:protobuf:2.5.0:*:*:*:*:*:*:*		pkg:maven/com.google.protobuf/protobuf-java@2.5.0HIGH4Highest27
quoin-0.1.2.jarpkg:maven/quoin/quoin@0.1.2 012
rhino-1.7R5.jarpkg:maven/org.mozilla/rhino@1.7R5 024
riddley-0.1.12.jarpkg:maven/riddley/riddley@0.1.12 014
slingshot-0.12.2.jarpkg:maven/slingshot/slingshot@0.12.2 012
spec.alpha-0.5.238.jarpkg:maven/org.clojure/spec.alpha@0.5.238 026
tools.reader-1.0.0-beta3.jarpkg:maven/org.clojure/tools.reader@1.0.0-beta3 020

Dependencies (vulnerable)

args4j-2.0.26.jar

Description:

args4j : Java command line arguments parser

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/args4j/args4j/2.0.26/args4j-2.0.26.jar
MD5: b786c33b2467a55d7b7b2c90886d5b61
SHA1: 01ebb18ebb3b379a74207d5af4ea7c8338ebd78b
SHA256:989bda2321ea073a03686e9d4437ea4928c72c99f993f9ca6fab24615f0771a4

Identifiers

clj-http-3.13.0.jar

Description:

A Clojure HTTP library wrapping the Apache HttpComponents client.

License:

The MIT License: http://opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/clj-http/clj-http/3.13.0/clj-http-3.13.0.jar
MD5: cb20d4314d2d443afe5add770cff1af7
SHA1: 6eb13a0d3a2aa1660305d06e47e0183392bf2c87
SHA256:225f197dc904601bf27669029f035284582283f167fa6fefc53c667f6211d79e

Identifiers

clojure-1.12.0.jar

Description:

Clojure core environment and runtime library.

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/clojure/1.12.0/clojure-1.12.0.jar
MD5: 674322e2210fcd1a807b3526f74c9242
SHA1: 8e0b7e60ea3c8f1ef4273d695b27a6cb85000571
SHA256:c45333006441a059ea9fdb1341fc6c1f40b921a10dccd82665311e48a0384763

Identifiers

clojurescript-1.9.293.jar

Description:

        ClojureScript compiler and core runtime library.

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/clojurescript/1.9.293/clojurescript-1.9.293.jar
MD5: 814254caf0b2a51b3a59fa548b11f074
SHA1: 9916db845e309c7a62caeaa2f71bce4ae878459b
SHA256:38666b281a5c35d79c23c8c8bac70ef120d19b66085ef3a9d232d153dbc79f2e

Identifiers

  • pkg:maven/org.clojure/clojurescript@1.9.293  (Confidence:High)
  • cpe:2.3:a:alex_project:alex:1.9.293:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bloom_project:bloom:1.9.293:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2023-0247  

Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
CWE-427 Uncontrolled Search Path Element

CVSSv3:
  • Base Score: HIGH (7.8)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

References:

Vulnerable Software & Versions:

closure-compiler-externs-v20160911.jar

File Path: /home/runner/.m2/repository/com/google/javascript/closure-compiler-externs/v20160911/closure-compiler-externs-v20160911.jar
MD5: 6b75cafae44cdee9617c59d070336444
SHA1: 3186e2c9a2018bb49547947d2919b0e6998a1fe2
SHA256:17c643badb57f696aa0df7a7aa32d554bc2c982e5a1c9d5343ae74c9c29307b7

Identifiers

closure-compiler-unshaded-v20160911.jar

Description:

    Closure Compiler is a JavaScript optimizing compiler. It parses your
    JavaScript, analyzes it, removes dead code and rewrites and minimizes
    what's left. It also checks syntax, variable references, and types, and
    warns about common JavaScript pitfalls. It is used in many of Google's
    JavaScript apps, including Gmail, Google Web Search, Google Maps, and
    Google Docs.

License:

http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/google/javascript/closure-compiler-unshaded/v20160911/closure-compiler-unshaded-v20160911.jar
MD5: 8a9c356db7759e05637aa14ef0e927d8
SHA1: 96ac7a8c32377690555ac93310498bebea3e26ef
SHA256:2a84364bf454525baaae523986d2d5b5d6904144f763f87180cfa4b21a0b2d68

Identifiers

codox-klipse-theme-0.0.1.jar

Description:

Klipse theme for codox

File Path: /home/runner/.m2/repository/viebel/codox-klipse-theme/0.0.1/codox-klipse-theme-0.0.1.jar
MD5: 6f5d908c6d9c890584158b9ebe8f2fed
SHA1: 09af0b348e6253dcf9fd567d0d22ffebdea46176
SHA256:806f94716f77585c66deb553d35481a0a66542328409466ffdd34d4f978fe2e1

Identifiers

commons-codec-1.16.1.jar

Description:

     The Apache Commons Codec component contains encoder and decoders for
     various formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
     widely used encoders and decoders, the codec package also maintains a
     collection of phonetic encoding utilities.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-codec/commons-codec/1.16.1/commons-codec-1.16.1.jar
MD5: 6c5be822d8d3fa61c3b54c4c8978dfdc
SHA1: 47bd4d333fba53406f6c6c51884ddbca435c8862
SHA256:ec87bfb55f22cbd1b21e2190eeda28b2b312ed2a431ee49fbdcc01812d04a5e4

Identifiers

commons-io-2.16.1.jar

Description:

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-io/commons-io/2.16.1/commons-io-2.16.1.jar
MD5: ed8191a5a217940140001b0acfed18d9
SHA1: 377d592e740dc77124e0901291dbfaa6810a200e
SHA256:f41f7baacd716896447ace9758621f62c1c6b0a91d89acee488da26fc477c84f

Identifiers

commons-logging-1.2.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well known logging systems.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA256:daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636

Identifiers

core.specs.alpha-0.4.74.jar

Description:

Specs for clojure.core

License:

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/
File Path: /home/runner/.m2/repository/org/clojure/core.specs.alpha/0.4.74/core.specs.alpha-0.4.74.jar
MD5: ebd37b9a3c39e6b769fc1463737cb8d4
SHA1: d56a8d4c666ff8140e6d0a62d41263134be39254
SHA256:eb73ac08cf49ba840c88ba67beef11336ca554333d9408808d78946e0feb9ddb

Identifiers

data.json-0.2.6.jar

Description:

Generating/parsing JSON from/to Clojure data structures

File Path: /home/runner/.m2/repository/org/clojure/data.json/0.2.6/data.json-0.2.6.jar
MD5: 75475cdb5e8b3d36e633e922a5c94eab
SHA1: ac3437a78d08f9db3dac7debe5a069edac282d95
SHA256:7f62619dcc6777521b6ee29eab69b29d71f826fff0d707ab37675eb22a229974

Identifiers

google-closure-library-0.0-20160609-f42b4a24.jar

Description:

        The Google Closure Library is a collection of JavaScript code
        designed for use with the Google Closure JavaScript Compiler.

        This non-official distribution was prepared by the ClojureScript
        team at http://clojure.org/

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/clojure/google-closure-library/0.0-20160609-f42b4a24/google-closure-library-0.0-20160609-f42b4a24.jar
MD5: f68473159ff1a17e4636e908762d5500
SHA1: f5585ba44bdd8981eeaf24dfd7a16921f9278b8d
SHA256:1285381f5ff1433cd6a1e6fe8b01a86263d7717ef20a7375c5b646879c05e659

Identifiers

CVE-2020-8910  

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
CWE-625 Permissive Regular Expression, NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:2.8/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions:

gson-2.2.4.jar

Description:

Google Gson library

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
MD5: 2f54fc24807a4cad7297012dd8cebf3d
SHA1: a60a5e993c98c864010053cb901b7eab25306568
SHA256:c0328cd07ca9e363a5acd00c1cf4afe8cf554bd6d373834981ba05cebec687fb

Identifiers

CVE-2022-25647  

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CWE-502 Deserialization of Untrusted Data

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

guava-19.0.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, google's collections, io classes, and much
    much more.

    Guava has only one code dependency - javax.annotation,
    per the JSR-305 spec.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar
MD5: 43bfc49bdc7324f6daaa60c1ee9f3972
SHA1: 6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9
SHA256:58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

Identifiers

CVE-2023-2976  

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
CWE-552 Files or Directories Accessible to External Parties

CVSSv3:
  • Base Score: HIGH (7.1)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

Vulnerable Software & Versions:

CVE-2018-10237  

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:2.2/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2020-8908  

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CWE-378 Creation of Temporary File With Insecure Permissions, CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

hickory-0.7.1.jar

Description:

HTML as Data

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/hickory/hickory/0.7.1/hickory-0.7.1.jar
MD5: 9610efdaad19f8d866059fc81f3144fd
SHA1: d9e6114592c434ca1df6022bbf4d5e97714666ee
SHA256:bf93934ae5f7ee17be851f34ca2e955b05f5bda4c650578daa41200056782a08

Identifiers

httpasyncclient-4.1.5.jar

Description:

   Apache HttpComponents AsyncClient

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpasyncclient/4.1.5/httpasyncclient-4.1.5.jar
MD5: 5346c547bfd0da64eb3dc54be9380d65
SHA1: cd18227f1eb8e9a263286c1d7362ceb24f6f9b32
SHA256:0c1877489a9d1ba4fa50f6cfcab11d1123618858cb31d56afaab5afdd5064d99

Identifiers

httpclient-4.5.14.jar

Description:

   Apache HttpComponents Client

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.14/httpclient-4.5.14.jar
MD5: 2cb357c4b763f47e58af6cad47df6ba3
SHA1: 1194890e6f56ec29177673f2f12d0b8e627dec98
SHA256:c8bc7e1c51a6d4ce72f40d2ebbabf1c4b68bfe76e732104b04381b493478e9d6

Identifiers

httpcore-4.4.16.jar

Description:

   Apache HttpComponents Core (blocking I/O)

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar
MD5: 28d2cd9bf8789fd2ec774fb88436ebd1
SHA1: 51cf043c87253c9f58b539c9f7e44c8894223850
SHA256:6c9b3dd142a09dc468e23ad39aad6f75a0f2b85125104469f026e52a474e464f

Identifiers

httpcore-nio-4.4.15.jar

Description:

   Apache HttpComponents Core (non-blocking I/O)

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpcore-nio/4.4.15/httpcore-nio-4.4.15.jar
MD5: 295da715492b1f7d4e38711f820e42a0
SHA1: 85d2b6825d42db909a1474f0ffbd6328429b7a32
SHA256:44ee3edb7d5e96d3e6d00263c838af23dd2ce67554129714ea30ae447ba95b92

Identifiers

httpmime-4.5.14.jar

Description:

   Apache HttpComponents HttpClient - MIME coded entities

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpmime/4.5.14/httpmime-4.5.14.jar
MD5: 714c4ae31c40e6633c0bcaa4e6264153
SHA1: 6662758a1f1cb1149cf916bdac28332e0902ec44
SHA256:d401243d5c6eae928a37121b6e819158c8c32ea0584793e7285bb489ab2a3d17

Identifiers

jsinterop-annotations-1.0.0.jar

File Path: /home/runner/.m2/repository/com/google/jsinterop/jsinterop-annotations/1.0.0/jsinterop-annotations-1.0.0.jar
MD5: 93302e3d0cc146097ecd08039dc1de52
SHA1: 23c3a3c060ffe4817e67673cc8294e154b0a4a95
SHA256:e5c1e0ceef98fb65a3d382641bcc1faab97649da1b422bbfc60e21b47345c854

Identifiers

jsoup-1.18.1.jar

Description:

jsoup is a Java library that simplifies working with real-world HTML and XML. It offers an easy-to-use API for URL fetching, data parsing, extraction, and manipulation using DOM API methods, CSS, and xpath selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers.

License:

The MIT License: https://jsoup.org/license
File Path: /home/runner/.m2/repository/org/jsoup/jsoup/1.18.1/jsoup-1.18.1.jar
MD5: d39a0c88a28969d13707b95e035d9442
SHA1: cb7cd991d47b44101cbe4655dec611cdc01f8a02
SHA256:3bb5b0ec02998abe45a51f37d7ce67c3068b4ccd4ab63c965929ec5074d64e91

Identifiers

jsr305-1.3.9.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar
MD5: 1d5a772e400b04bb67a7ef4a0e0996d8
SHA1: 40719ea6961c0cb6afaeb6a921eaa1f6afd4cfdf
SHA256:905721a0eea90a81534abb7ee6ef4ea2e5e645fa1def0a5cd88402df1b46c9ed

Identifiers

potemkin-0.4.7.jar

Description:

Some useful facades.

License:

MIT License
File Path: /home/runner/.m2/repository/potemkin/potemkin/0.4.7/potemkin-0.4.7.jar
MD5: 1f35526c3cd74f6bb47421c03f8bcfc4
SHA1: 5daf7733d60148213807f6e07c1a6f95a2b279f4
SHA256:b98fb8d7e79bfc3ace0f2154c853973a5831a312168845f970475aa193cb1195

Identifiers

protobuf-java-2.5.0.jar

Description:

    Protocol Buffers are a way of encoding structured data in an efficient yet
    extensible format.

License:

New BSD license: http://www.opensource.org/licenses/bsd-license.php
File Path: /home/runner/.m2/repository/com/google/protobuf/protobuf-java/2.5.0/protobuf-java-2.5.0.jar
MD5: a44473b98947e2a54c54e0db1387d137
SHA1: a10732c76bfacdbd633a7eb0f7968b1059a65dfa
SHA256:e0c1c64575c005601725e7c6a02cebf9e1285e888f756b2a1d73ffa8d725cc74

Identifiers

CVE-2024-7254 (OSSINDEX)  

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2024-7254 for details
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (8.699999809265137)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.google.protobuf:protobuf-java:2.5.0:*:*:*:*:*:*:*

CVE-2022-3171  

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CWE-20 Improper Input Validation, NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2022-3509 (OSSINDEX)  

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.google.protobuf:protobuf-java:2.5.0:*:*:*:*:*:*:*

CVE-2021-22569  

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
NVD-CWE-noinfo, CWE-696 Incorrect Behavior Order

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

quoin-0.1.2.jar

Description:

Template engine support and utilities

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/quoin/quoin/0.1.2/quoin-0.1.2.jar
MD5: 28fed3a5e6b218208e3d42768e354053
SHA1: 0dbbb28df3e337233f934468915eb327ff488172
SHA256:655d5b6ba4057cdbbeeab163c00cdaede8d72880db4b80e8c5e8bd555960b92c

Identifiers

rhino-1.7R5.jar

Description:

      Rhino is an open-source implementation of JavaScript written entirely in Java. It is typically
      embedded into Java applications to provide scripting to end users.

License:

Mozilla Public License, Version 2.0: http://www.mozilla.org/MPL/2.0/index.txt
File Path: /home/runner/.m2/repository/org/mozilla/rhino/1.7R5/rhino-1.7R5.jar
MD5: 515233bd8a534c0468f6e397fc6b1925
SHA1: 95f0003cea7ebf26aef5ed64c77c05fcd1ff9648
SHA256:e00e09a71abc4677e17dd8d42b0755b59a9e9ab09b60fd8b1abb45e4c80409c0

Identifiers

riddley-0.1.12.jar

Description:

code-walking without caveats

License:

MIT License: http://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/riddley/riddley/0.1.12/riddley-0.1.12.jar
MD5: c13a93e1a748f6d0b775e576e523cb42
SHA1: 033bd1610a8ef50a6347cd571eaef76182ca50b0
SHA256:398f61fa4825b8f86c916ae580c7e133b7c477d0b72a7d3b298d381032740bae

Identifiers

slingshot-0.12.2.jar

Description:

Enhanced throw, try, leveraging Clojure's capabilities

License:

Eclipse Public License 1.0: https://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/slingshot/slingshot/0.12.2/slingshot-0.12.2.jar
MD5: 4793bec2229ccc655d62fcc5b47cbd77
SHA1: be4aed05849752f9ac5d09691755dec3dd8ed5f3
SHA256:a68ac22bf2ea3cd54ce34db70fd69844d631ef549f6450c278c30e6f79df63f3

Identifiers

spec.alpha-0.5.238.jar

Description:

Specification of data and functions

License:

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/
File Path: /home/runner/.m2/repository/org/clojure/spec.alpha/0.5.238/spec.alpha-0.5.238.jar
MD5: 9f5ea5239dc04d6a8115add1e4f5f23a
SHA1: 4eb5dea521c4e6e1f68c2c47517f14a922003e60
SHA256:94cd99b6ea639641f37af4860a643b6ed399ee5a8be5d717cff0b663c8d75077

Identifiers

tools.reader-1.0.0-beta3.jar

Description:

A Clojure reader in Clojure

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/tools.reader/1.0.0-beta3/tools.reader-1.0.0-beta3.jar
MD5: bdd4123ff87e24444f4a59cbe84eb9d9
SHA1: 2551fe91105779f8641ed51d8eb21f1bf50b49e4
SHA256:da123ee25d9515c7b9edc871e11ab0332d58904ca7af854b3ddc2d34332ad7bc

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.