Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: AEM Content Package Builder

io.wcm.tooling.commons:io.wcm.tooling.commons.content-package-builder:1.6.3-SNAPSHOT

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
commons-io-2.5.jarcpe:2.3:a:apache:commons_io:2.5:*:*:*:*:*:*:*pkg:maven/commons-io/commons-io@2.5MEDIUM1Highest40
commons-lang3-3.6.jarpkg:maven/org.apache.commons/commons-lang3@3.6 041
guava-15.0.jarcpe:2.3:a:google:guava:15.0:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@15.0MEDIUM2Highest20
jackrabbit-api-2.16.0.jarcpe:2.3:a:apache:jackrabbit:2.16.0:*:*:*:*:*:*:*pkg:maven/org.apache.jackrabbit/jackrabbit-api@2.16.0 0Highest29
jcr-2.0.jarpkg:maven/javax.jcr/jcr@2.0 032
org.apache.jackrabbit.vault-3.1.44.jarcpe:2.3:a:apache:jackrabbit:3.1.44:*:*:*:*:*:*:*pkg:maven/org.apache.jackrabbit.vault/org.apache.jackrabbit.vault@3.1.44 0Highest39
org.apache.jackrabbit.vault-3.1.44.jar: jackrabbit-spi-2.16.1.jarcpe:2.3:a:apache:jackrabbit:2.16.1:*:*:*:*:*:*:*pkg:maven/org.apache.jackrabbit/jackrabbit-spi@2.16.1 0Highest28

Dependencies

commons-io-2.5.jar

Description:

The Apache Commons IO library contains utility classes, stream implementations, file filters, 
file comparators, endian transformation classes, and much more.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-io/commons-io/2.5/commons-io-2.5.jar
MD5: e2d74794fba570ec2115fb9d5b05dc9b
SHA1: 2852e6e05fbb95076fc091f6d1780f1f8fe35e0f
SHA256:a10418348d234968600ccb1d988efcbbd08716e1d96936ccc1880e7d22513474
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

CVE-2021-29425  

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (4.8)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

commons-lang3-3.6.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.6/commons-lang3-3.6.jar
MD5: 5d18f68b5122fd398c118df53ab4cf55
SHA1: 9d28a6b23650e8a7e9063c04588ace6cf7012c17
SHA256:89c27f03fff18d0b06e7afd7ef25e209766df95b6c1269d6c3ebbdea48d5f284
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

guava-15.0.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, google's collections, io classes, and much
    much more.

    Guava has two code dependencies - javax.annotation
    per the JSR-305 spec and javax.inject per the JSR-330 spec.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/guava/15.0/guava-15.0.jar
MD5: 2c10bb2ca3ac8b55b0e77e54a7eb3744
SHA1: ed727a8d9f247e2050281cb083f1c77b09dcb5cd
SHA256:7a34575770eebc60a5476616e3676a6cb6f2975c78c415e2a6014ac724ba5783
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

CVE-2018-10237  

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-8908  

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

jackrabbit-api-2.16.0.jar

Description:

Jackrabbit-specific extensions to the JCR API

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/jackrabbit/jackrabbit-api/2.16.0/jackrabbit-api-2.16.0.jar
MD5: 4f66766e7153e75726867e49781346c4
SHA1: 0bda9c9da2ca4d6fc14918ebf7b5ab1f72e5a089
SHA256:51e881d990efef071ea6f201fce7e6c660f359faa10873106017098a506e0953
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

jcr-2.0.jar

Description:

        The Content Repository API for JavaTM Technology Version 2.0 is specified by JSR-283.
        This module contains the complete API as specified.

License:

Day Specification License: http://www.day.com/dam/day/downloads/jsr283/day-spec-license.htm
Day Specification License addendum: http://www.day.com/content/dam/day/downloads/jsr283/LICENSE.txt
File Path: /home/runner/.m2/repository/javax/jcr/jcr/2.0/jcr-2.0.jar
MD5: ede5e78b16c8ed298ce0b6d296584ebd
SHA1: 08297216bcfe4aea369ed6ee0d1718133f752e97
SHA256:cbf083bc58cb88a0c19112187a4c52d3115f525b5bb7f2913635f5679e6e9743
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

org.apache.jackrabbit.vault-3.1.44.jar

Description:

        Builds an OSGi bundle for the file vault parts

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/jackrabbit/vault/org.apache.jackrabbit.vault/3.1.44/org.apache.jackrabbit.vault-3.1.44.jar
MD5: 6fcbf022b81ce371d7c31d06d1a147ba
SHA1: 10b5306bf2432bfd8a4ec3b18007eff383985808
SHA256:42d903a39f2b8c4003f9c58510abb049655399157cfc760540a58daf35273735
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers

org.apache.jackrabbit.vault-3.1.44.jar: jackrabbit-spi-2.16.1.jar

Description:

The Apache Jackrabbit™ content repository is a fully conforming    implementation of the Content Repository for Java Technology API    (JCR, specified in JSR 170 and 283). A content repository is a    hierarchical content store with support for structured and unstructured    content, full text search, versioning, transactions, observation, and more.    Apache Jackrabbit is a project of the Apache Software Foundation.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/jackrabbit/vault/org.apache.jackrabbit.vault/3.1.44/org.apache.jackrabbit.vault-3.1.44.jar/jackrabbit-spi-2.16.1.jar
MD5: 34af186319cfc56397ae5374275b7255
SHA1: d8fa398bc1ef0d943a94c0b93bf000705fd5c13d
SHA256:4b09b47b7fe69f12c2d9f61d9bc97a3881b140d79c22453e32e84b95edf8b006
Referenced In Project/Scope:AEM Content Package Builder:compile

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the NPM Public Advisories.
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.