{"version": "15.0.6","schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.6/dist/dependency-scanning-report-format.json?ref_type=tags", "scan": {"scanner": {"id": "org.owasp.dependency-check","name": "Dependency-Check Core","version": "9.0.9","vendor": {"name": "OWASP"},"url": "https://github.com/jeremylong/DependencyCheck/"},"analyzer": {"id": "org.owasp.dependency-check","name": "Dependency-Check Core","version": "9.0.9","vendor": {"name": "OWASP"},"url": "https://github.com/jeremylong/DependencyCheck/"},"end_time": "2024-03-08T11:56:28","start_time": "2024-03-08T11:56:28","status":  "success"  ,"type": "dependency_scanning"},"vulnerabilities": [{"id": "CVE-2022-31159","identifiers": [{"type": "NVD", "name": "CVE-2022-31159", "value": "9e9bd0bfd6173dbe603ef3a386a3b604f62b06d2", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31159"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/aws-java-sdk-core\/1.11.415\/aws-java-sdk-core-1.11.415.jar","dependency": {"package": {"name": "com.amazonaws:aws-java-sdk-core"},"version": "1.11.415"}},"name": "CVE-2022-31159","description": "The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue\uFFFD\uFFFD\uFFFDs scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`\/tmp\/foo`, the actor can cause a download to `\/tmp\/foo-bar`, but not `\/tmp\/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .","severity": "Medium","links": [{"name": "EXPLOIT,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/aws\/aws-sdk-java\/security\/advisories\/GHSA-c28r-hw5m-5gv3"}]},{"id": "CVE-2020-26939","identifiers": [{"type": "NVD", "name": "CVE-2020-26939", "value": "14ff2dfec8578f5f6838c4d6a77a86789afe5382", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26939"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcmail-jdk14\/138\/bcmail-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcmail-jdk14"},"version": "138"}},"name": "CVE-2020-26939","description": "In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.","severity": "Medium","links": [{"url": "https:\/\/lists.apache.org\/thread.html\/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e%40%3Cissues.solr.apache.org%3E"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/wiki\/CVE-2020-26939"}]},{"id": "CVE-2007-6721","identifiers": [{"type": "NVD", "name": "CVE-2007-6721", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6721"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2007-6721","description": "The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to \"a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.\"","severity": "High","links": [{"url": "http:\/\/freshmeat.net\/projects\/bouncycastlecryptoapi\/releases\/265580"},{"url": "http:\/\/www.bouncycastle.org\/releasenotes.html"},{"url": "http:\/\/www.osvdb.org\/50358"},{"url": "http:\/\/www.osvdb.org\/50359"},{"url": "http:\/\/www.osvdb.org\/50360"},{"name": "PATCH,VENDOR_ADVISORY","url": "http:\/\/www.bouncycastle.org\/csharp\/"},{"name": "PATCH,VENDOR_ADVISORY","url": "http:\/\/www.bouncycastle.org\/devmailarchive\/msg08195.html"}]},{"id": "CVE-2020-28052","identifiers": [{"type": "NVD", "name": "CVE-2020-28052", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28052"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2020-28052","description": "An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.","severity": "High","links": [{"url": "https:\/\/lists.apache.org\/thread.html\/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53%40%3Ccommits.pulsar.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r37d332c0bf772f4982d1fdeeb2f88dd71dab6451213e69e43734eadc%40%3Ccommits.pulsar.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b94%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f%40%3Ccommits.druid.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271c%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rcd37d9214b08067a2e8f2b5b4fd123a1f8cb6008698d11ef44028c21%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rdcbad6d8ce72c79827ed8c635f9a62dd919bb21c94a0b64cab2efc31%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rddd2237b8636a48d573869006ee809262525efb2b6ffa6eff50d2a2d%40%3Cjira.kafka.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6e%40%3Ccommits.druid.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de22402%40%3Cissues.karaf.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rfc0db1f3c375087e69a239f9284ded72d04fbb55849eadde58fa9dc2%40%3Cissues.karaf.apache.org%3E"},{"name": "EXPLOIT,THIRD_PARTY_ADVISORY","url": "https:\/\/www.synopsys.com\/blogs\/software-security\/cve-2020-28052-bouncy-castle\/"},{"name": "MITIGATION,PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/wiki\/CVE-2020-28052"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/\/security-alerts\/cpujul2021.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2022.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2022.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2022.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2021.html"},{"name": "RELEASE_NOTES,VENDOR_ADVISORY","url": "https:\/\/www.bouncycastle.org\/releasenotes.html"}]},{"id": "CVE-2016-1000338","identifiers": [{"type": "NVD", "name": "CVE-2016-1000338", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000338"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000338","description": "In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","severity": "High","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/lists.apache.org\/thread.html\/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20231006-0011\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "MAILING_LIST,THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0"}]},{"id": "CVE-2016-1000342","identifiers": [{"type": "NVD", "name": "CVE-2016-1000342", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000342"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000342","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","severity": "High","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2016-1000343","identifiers": [{"type": "NVD", "name": "CVE-2016-1000343", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000343"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000343","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.","severity": "High","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/lists.apache.org\/thread.html\/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2019-17359","identifiers": [{"type": "NVD", "name": "CVE-2019-17359", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17359"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2019-17359","description": "The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.","severity": "High","links": [{"url": "https:\/\/lists.apache.org\/thread.html\/r02f887807a49cfd1f1ad53f7a61f3f8e12f60ba2c930bec163031209%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r16c3a90cb35ae8a9c74fd5c813c16d6ac255709c9f9d71cd409e007d%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r467ade3fef3493f1fff1a68a256d087874e1f858ad1de7a49fe05d27%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r4d475dcaf4f57115fa57d8e06c3823ca398b35468429e7946ebaefdc%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r79b6a6aa0dd1aeb57bd253d94794bc96f1ec005953c4bd5414cc0db0%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r8ecb5b76347f84b6e3c693f980dbbead88c25f77b815053c4e6f2c30%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r91b07985b1307390a58c5b9707f0b28ef8e9c9e1c86670459f20d601%40%3Ccommits.tomee.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/re60f980c092ada4bfe236dcfef8b6ca3e8f3b150fc0f51b8cc13d59d%40%3Ccommits.tomee.apache.org%3E"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2021.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "RELEASE_NOTES,VENDOR_ADVISORY","url": "https:\/\/www.bouncycastle.org\/latest_releases.html"},{"name": "RELEASE_NOTES,VENDOR_ADVISORY","url": "https:\/\/www.bouncycastle.org\/releasenotes.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/security.netapp.com\/advisory\/ntap-20191024-0006\/"}]},{"id": "CVE-2016-1000344","identifiers": [{"type": "NVD", "name": "CVE-2016-1000344", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000344"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000344","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","severity": "High","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/9385b0ebd277724b167fe1d1456e3c112112be1f"}]},{"id": "CVE-2016-1000352","identifiers": [{"type": "NVD", "name": "CVE-2016-1000352", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000352"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000352","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","severity": "High","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/9385b0ebd277724b167fe1d1456e3c112112be1f"}]},{"id": "CVE-2016-1000341","identifiers": [{"type": "NVD", "name": "CVE-2016-1000341", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000341"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000341","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.","severity": "Medium","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2016-1000345","identifiers": [{"type": "NVD", "name": "CVE-2016-1000345", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000345"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000345","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES\/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.","severity": "Medium","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2017-13098","identifiers": [{"type": "NVD", "name": "CVE-2017-13098", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13098"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2017-13098","description": "BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as \"ROBOT.\"","severity": "Medium","links": [{"url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-05\/msg00011.html"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "ISSUE_TRACKING,MITIGATION,THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE","url": "http:\/\/www.kb.cert.org\/vuls\/id\/144389"},{"name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/a00b684465b38d722ca9a3543b8af8568e6bad5c"},{"name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/robotattack.org\/"},{"name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/security.netapp.com\/advisory\/ntap-20171222-0001\/"},{"name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/www.debian.org\/security\/2017\/dsa-4072"},{"name": "THIRD_PARTY_ADVISORY,VDB_ENTRY","url": "http:\/\/www.securityfocus.com\/bid\/102195"}]},{"id": "CVE-2020-15522","identifiers": [{"type": "NVD", "name": "CVE-2020-15522", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15522"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2020-15522","description": "Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.","severity": "Medium","links": [{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20210622-0007\/"},{"name": "RELEASE_NOTES,VENDOR_ADVISORY","url": "https:\/\/www.bouncycastle.org\/releasenotes.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-csharp\/wiki\/CVE-2020-15522"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/wiki\/CVE-2020-15522"}]},{"id": "CVE-2016-2427","identifiers": [{"type": "NVD", "name": "CVE-2016-2427", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2427"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-2427","description": "The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568.  NOTE: The vendor disputes the existence of this potential issue in Android, stating \"This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed.","severity": "Medium","links": [{"name": "VENDOR_ADVISORY","url": "http:\/\/source.android.com\/security\/bulletin\/2016-04-02.html"}]},{"id": "CVE-2016-1000339","identifiers": [{"type": "NVD", "name": "CVE-2016-1000339", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000339"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000339","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.","severity": "Medium","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/413b42f4d770456508585c830cfcde95f9b0e93b#diff-54656f860db94b867ba7542430cd2ef0"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/8a73f08931450c17c749af067b6a8185abdfd2c0#diff-494fb066bed02aeb76b6c005632943f2"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2020-26939","identifiers": [{"type": "NVD", "name": "CVE-2020-26939", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26939"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2020-26939","description": "In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.","severity": "Medium","links": [{"url": "https:\/\/lists.apache.org\/thread.html\/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e%40%3Cissues.solr.apache.org%3E"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/wiki\/CVE-2020-26939"}]},{"id": "CVE-2015-7940","identifiers": [{"type": "NVD", "name": "CVE-2015-7940", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7940"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2015-7940","description": "The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an \"invalid curve attack.\"","severity": "Medium","links": [{"url": "http:\/\/lists.fedoraproject.org\/pipermail\/package-announce\/2016-January\/174915.html"},{"url": "http:\/\/rhn.redhat.com\/errata\/RHSA-2016-2035.html"},{"url": "http:\/\/rhn.redhat.com\/errata\/RHSA-2016-2036.html"},{"url": "http:\/\/www.debian.org\/security\/2015\/dsa-3417"},{"url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuapr2018-3678067.html"},{"url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujan2018-3236628.html"},{"url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujul2017-3236622.html"},{"url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujul2018-4258247.html"},{"url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2017-3236626.html"},{"url": "http:\/\/www.securityfocus.com\/bid\/79091"},{"url": "http:\/\/www.securitytracker.com\/id\/1037036"},{"url": "http:\/\/www.securitytracker.com\/id\/1037046"},{"url": "http:\/\/www.securitytracker.com\/id\/1037053"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2020.html"},{"url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujan2019-5072801.html"},{"name": "TECHNICAL_DESCRIPTION","url": "http:\/\/web-in-security.blogspot.ca\/2015\/09\/practical-invalid-curve-attacks.html"},{"name": "THIRD_PARTY_ADVISORY","url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2015-11\/msg00012.html"},{"name": "THIRD_PARTY_ADVISORY","url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2016-2881722.html"},{"name": "THIRD_PARTY_ADVISORY,VDB_ENTRY","url": "http:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/22\/7"},{"name": "THIRD_PARTY_ADVISORY,VDB_ENTRY","url": "http:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/22\/9"}]},{"id": "CVE-2018-5382","identifiers": [{"type": "NVD", "name": "CVE-2018-5382", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5382"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2018-5382","description": "The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type \"BKS-V1\" was introduced in 1.49. It should be noted that the use of \"BKS-V1\" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.","severity": "Medium","links": [{"name": "RELEASE_NOTES,VENDOR_ADVISORY","url": "https:\/\/www.bouncycastle.org\/releasenotes.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE","url": "https:\/\/www.kb.cert.org\/vuls\/id\/306792"},{"name": "THIRD_PARTY_ADVISORY,VDB_ENTRY","url": "http:\/\/www.securityfocus.com\/bid\/103453"}]},{"id": "CVE-2013-1624","identifiers": [{"type": "NVD", "name": "CVE-2013-1624", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1624"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2013-1624","description": "The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","severity": "Medium","links": [{"url": "http:\/\/openwall.com\/lists\/oss-security\/2013\/02\/05\/24"},{"url": "http:\/\/rhn.redhat.com\/errata\/RHSA-2014-0371.html"},{"url": "http:\/\/rhn.redhat.com\/errata\/RHSA-2014-0372.html"},{"url": "http:\/\/secunia.com\/advisories\/57716"},{"url": "http:\/\/secunia.com\/advisories\/57719"},{"url": "http:\/\/www.isg.rhul.ac.uk\/tls\/TLStiming.pdf"}]},{"id": "CVE-2016-1000346","identifiers": [{"type": "NVD", "name": "CVE-2016-1000346", "value": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000346"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","dependency": {"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"}},"name": "CVE-2016-1000346","description": "In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.","severity": "Low","links": [{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2669"},{"url": "https:\/\/access.redhat.com\/errata\/RHSA-2018:2927"},{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20181127-0004\/"},{"url": "https:\/\/usn.ubuntu.com\/3727-1\/"},{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/commit\/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/lists.debian.org\/debian-lts-announce\/2018\/07\/msg00009.html"}]},{"id": "CVE-2023-33202","identifiers": [{"type": "NVD", "name": "CVE-2023-33202", "value": "4821122f8390d15f4b5ee652621e2a2bb1f1bf16", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33202"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/bouncycastle\/bctsp-jdk14\/1.38\/bctsp-jdk14-1.38.jar","dependency": {"package": {"name": "org.bouncycastle:bctsp-jdk14"},"version": "1.38"}},"name": "CVE-2023-33202","description": "Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)","severity": "Medium","links": [{"url": "https:\/\/security.netapp.com\/advisory\/ntap-20240125-0001\/"},{"name": "EXPLOIT,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/bcgit\/bc-java\/wiki\/CVE-2023-33202"},{"name": "PRODUCT","url": "https:\/\/bouncycastle.org"}]},{"id": "CVE-2020-13956","identifiers": [{"type": "NVD", "name": "CVE-2020-13956", "value": "1603dfd56ebcd583ccdf337b6c3984ac55d89e58", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13956"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/httpclient\/4.5.5\/httpclient-4.5.5.jar","dependency": {"package": {"name": "org.apache.httpcomponents:httpclient"},"version": "4.5.5"}},"name": "CVE-2020-13956","description": "Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.","severity": "Medium","links": [{"url": "https:\/\/lists.apache.org\/thread.html\/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E"},{"url": "https:\/\/lists.apache.org\/thread.html\/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E"},{"name": "MAILING_LIST,VENDOR_ADVISORY","url": "https:\/\/lists.apache.org\/thread.html\/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/\/security-alerts\/cpujul2021.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2022.html"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2021.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/security.netapp.com\/advisory\/ntap-20220210-0002\/"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2022.html"}]},{"id": "CVE-2024-21634","identifiers": [{"type": "NVD", "name": "CVE-2024-21634", "value": "ee9dacea7726e495f8352b81c12c23834ffbc564", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21634"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/software\/amazon\/ion\/ion-java\/1.0.2\/ion-java-1.0.2.jar","dependency": {"package": {"name": "software.amazon.ion:ion-java"},"version": "1.0.2"}},"name": "CVE-2024-21634","description": "Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDfor applications that use\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDto deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel and then invoke certain\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmethods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and\/or processed using the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel, results in a\uFFFD\uFFFD`StackOverflowError`\uFFFD\uFFFDoriginating from the\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDlibrary. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","severity": "High","links": [{"name": "VENDOR_ADVISORY","url": "https:\/\/github.com\/amazon-ion\/ion-java\/security\/advisories\/GHSA-264p-99wq-f4j6"}]},{"id": "CVE-2017-9096","identifiers": [{"type": "NVD", "name": "CVE-2017-9096", "value": "892bfb3e97074a61123b3b2d7caa2db112750864", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9096"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","dependency": {"package": {"name": "com.lowagie:itext"},"version": "2.1.7"}},"name": "CVE-2017-9096","description": "The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.","severity": "High","links": [{"url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/support.hpe.com\/hpsc\/doc\/public\/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/www.compass-security.com\/fileadmin\/Datein\/Research\/Advisories\/CSNC-2017-017_itext_xml_external_entity_attack.txt"},{"name": "THIRD_PARTY_ADVISORY,VDB_ENTRY","url": "http:\/\/www.securityfocus.com\/archive\/1\/541483\/100\/0\/threaded"}]},{"id": "CVE-2022-24196","identifiers": [{"type": "NVD", "name": "CVE-2022-24196", "value": "892bfb3e97074a61123b3b2d7caa2db112750864", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24196"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","dependency": {"package": {"name": "com.lowagie:itext"},"version": "2.1.7"}},"name": "CVE-2022-24196","description": "iText v7.1.17, up to (exluding)\": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.","severity": "Medium","links": [{"url": "https:\/\/github.com\/itext\/itext7\/releases\/tag\/7.1.18"},{"name": "EXPLOIT,PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/itext\/itext7\/pull\/78#issuecomment-1089279222"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/itext\/itext7\/pull\/78"}]},{"id": "CVE-2022-24197","identifiers": [{"type": "NVD", "name": "CVE-2022-24197", "value": "892bfb3e97074a61123b3b2d7caa2db112750864", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24197"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","dependency": {"package": {"name": "com.lowagie:itext"},"version": "2.1.7"}},"name": "CVE-2022-24197","description": "iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.","severity": "Medium","links": [{"url": "https:\/\/github.com\/itext\/itext7\/releases\/tag\/7.1.18"},{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/itext\/itext7\/pull\/78#issuecomment-1089282165"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/itext\/itext7\/pull\/78"}]},{"id": "CVE-2023-35116","identifiers": [{"type": "NVD", "name": "CVE-2023-35116", "value": "a734bc2c47a9453c4efa772461a3aeb273c010d9", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-35116"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/core\/jackson-databind\/2.15.3\/jackson-databind-2.15.3.jar","dependency": {"package": {"name": "com.fasterxml.jackson.core:jackson-databind"},"version": "2.15.3"}},"name": "CVE-2023-35116","description": "jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.","severity": "Medium","links": [{"name": "ISSUE_TRACKING","url": "https:\/\/github.com\/FasterXML\/jackson-databind\/issues\/3972"}]},{"id": "CVE-2022-31159","identifiers": [{"type": "NVD", "name": "CVE-2022-31159", "value": "9331fc5c6ee158395303d326d4deda1a4a2a409f", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31159"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/jmespath-java\/1.11.415\/jmespath-java-1.11.415.jar","dependency": {"package": {"name": "com.amazonaws:jmespath-java"},"version": "1.11.415"}},"name": "CVE-2022-31159","description": "The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue\uFFFD\uFFFD\uFFFDs scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`\/tmp\/foo`, the actor can cause a download to `\/tmp\/foo-bar`, but not `\/tmp\/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .","severity": "Medium","links": [{"name": "EXPLOIT,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/aws\/aws-sdk-java\/security\/advisories\/GHSA-c28r-hw5m-5gv3"}]},{"id": "CVE-2022-45688","identifiers": [{"type": "NVD", "name": "CVE-2022-45688", "value": "06df2c050972619466f6dcef7654ef9bcc01dfd0", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-45688"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/json\/json\/20220320\/json-20220320.jar","dependency": {"package": {"name": "org.json:json"},"version": "20220320"}},"name": "CVE-2022-45688","description": "A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.","severity": "High","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/dromara\/hutool\/issues\/2748"},{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/stleary\/JSON-java\/issues\/708"}]},{"id": "CVE-2023-5072","identifiers": [{"type": "NVD", "name": "CVE-2023-5072", "value": "06df2c050972619466f6dcef7654ef9bcc01dfd0", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5072"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/json\/json\/20220320\/json-20220320.jar","dependency": {"package": {"name": "org.json:json"},"version": "20220320"}},"name": "CVE-2023-5072","description": "Denial of Service  in JSON-Java versions up to and including 20230618. \uFFFD\uFFFDA bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.\uFFFD\uFFFD\n","severity": "High","links": [{"url": "http:\/\/www.openwall.com\/lists\/oss-security\/2023\/12\/13\/4"},{"name": "EXPLOIT,ISSUE_TRACKING","url": "https:\/\/github.com\/stleary\/JSON-java\/issues\/771"},{"name": "ISSUE_TRACKING","url": "https:\/\/github.com\/stleary\/JSON-java\/issues\/758"}]},{"id": "CVE-2023-51074","identifiers": [{"type": "NVD", "name": "CVE-2023-51074", "value": "b4ab3b7a9e425655a0ca65487bbbd6d7ddb75160", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51074"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/jayway\/jsonpath\/json-path\/2.8.0\/json-path-2.8.0.jar","dependency": {"package": {"name": "com.jayway.jsonpath:json-path"},"version": "2.8.0"}},"name": "CVE-2023-51074","description": "json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.","severity": "Medium","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/json-path\/JsonPath\/issues\/973"}]},{"id": "CVE-2022-47932","identifiers": [{"type": "NVD", "name": "CVE-2022-47932", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47932"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2022-47932","description": "Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.","severity": "Medium","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/24093"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/commit\/e73309665508c17e48a67e302d3ab02a38d3ef50"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/pull\/14211"},{"name": "PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1636430"}]},{"id": "CVE-2022-47933","identifiers": [{"type": "NVD", "name": "CVE-2022-47933", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47933"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2022-47933","description": "Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.","severity": "Medium","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/23646"},{"name": "ISSUE_TRACKING,RELEASE_NOTES,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/24378"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/commit\/7ef8cb2f232abdf59ec9c3c99a086a14b972bc56"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/pull\/13989"},{"name": "PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1610343"}]},{"id": "CVE-2022-47934","identifiers": [{"type": "NVD", "name": "CVE-2022-47934", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47934"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2022-47934","description": "Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.","severity": "Medium","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/24211"},{"name": "ISSUE_TRACKING,RELEASE_NOTES,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/25106"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/commit\/82d8e39043e691e0492519126437275511ee87e8"},{"name": "PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/pull\/14313"},{"name": "PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1646204"}]},{"id": "CVE-2021-22929","identifiers": [{"type": "NVD", "name": "CVE-2021-22929", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22929"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2021-22929","description": "An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.","severity": "Medium","links": [{"name": "EXPLOIT,PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1249056"}]},{"id": "CVE-2020-8276","identifiers": [{"type": "NVD", "name": "CVE-2020-8276", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8276"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2020-8276","description": "The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window.","severity": "Medium","links": [{"name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1024668"}]},{"id": "CVE-2022-30334","identifiers": [{"type": "NVD", "name": "CVE-2022-30334", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30334"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2022-30334","description": "Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises \"Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser.\"","severity": "Medium","links": [{"name": "EXPLOIT,PATCH,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-core\/pull\/10760"},{"name": "EXPLOIT,THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1337624"},{"name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY","url": "https:\/\/github.com\/brave\/brave-browser\/issues\/18071"},{"name": "VENDOR_ADVISORY","url": "https:\/\/support.brave.com\/hc\/en-us\/articles\/360018121491-What-is-a-Private-Window-with-Tor-Connectivity-"}]},{"id": "CVE-2023-28360","identifiers": [{"type": "NVD", "name": "CVE-2023-28360", "value": "19546fa2444d7383be593bb3939b1f0d079e4490", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28360"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","dependency": {"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"}},"name": "CVE-2023-28360","description": "An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.","severity": "Medium","links": [{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/hackerone.com\/reports\/1848062"}]},{"id": "CVE-2023-22102","identifiers": [{"type": "NVD", "name": "CVE-2023-22102", "value": "41ec3f8cdaccf6c46a47d7cd628eeb59a926d9d4", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22102"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/com\/mysql\/mysql-connector-j\/8.0.32\/mysql-connector-j-8.0.32.jar","dependency": {"package": {"name": "com.mysql:mysql-connector-j"},"version": "8.0.32"}},"name": "CVE-2023-22102","description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector\/J).  Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H).","severity": "High","links": [{"name": "PATCH,VENDOR_ADVISORY","url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2023.html"},{"name": "THIRD_PARTY_ADVISORY","url": "https:\/\/security.netapp.com\/advisory\/ntap-20231027-0007\/"}]},{"id": "CVE-2020-5410","identifiers": [{"type": "NVD", "name": "CVE-2020-5410", "value": "39aecb058614da88cdf46b6207b4c0823f5495e9", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5410"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-autoconfigure\/2.1.3.RELEASE\/spring-cloud-aws-autoconfigure-2.1.3.RELEASE.jar","dependency": {"package": {"name": "org.springframework.cloud:spring-cloud-aws-autoconfigure"},"version": "2.1.3.RELEASE"}},"name": "CVE-2020-5410","description": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","severity": "High","links": [{"name": "VENDOR_ADVISORY","url": "https:\/\/tanzu.vmware.com\/security\/cve-2020-5410"}]},{"id": "CVE-2020-5405","identifiers": [{"type": "NVD", "name": "CVE-2020-5405", "value": "39aecb058614da88cdf46b6207b4c0823f5495e9", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5405"}],"location": {"file": "\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-autoconfigure\/2.1.3.RELEASE\/spring-cloud-aws-autoconfigure-2.1.3.RELEASE.jar","dependency": {"package": {"name": "org.springframework.cloud:spring-cloud-aws-autoconfigure"},"version": "2.1.3.RELEASE"}},"name": "CVE-2020-5405","description": "Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","severity": "Medium","links": [{"name": "VENDOR_ADVISORY","url": "https:\/\/pivotal.io\/security\/cve-2020-5405"}]}],"dependency_files": [{"path": "pom.xml","package_manager": "maven","dependencies": [{"package": {"name": "org.hdrhistogram:HdrHistogram"},"version": "2.1.12"},{"package": {"name": "com.zaxxer:HikariCP"},"version": "5.0.1"},{"package": {"name": "org.latencyutils:LatencyUtils"},"version": "2.0.3"},{"package": {"name": "net.minidev:accessors-smart"},"version": "2.5.0"},{"package": {"name": "javax.activation:activation"},"version": "1.1.1"},{"package": {"name": "com.rabbitmq:amqp-client"},"version": "5.19.0"},{"package": {"name": "aopalliance:aopalliance"},"version": "1.0"},{"package": {"name": "org.ow2.asm:asm"},"version": "9.3"},{"package": {"name": "org.aspectj:aspectjweaver"},"version": "1.9.21"},{"package": {"name": "io.netfoundry:authorization"},"version": "2.5.0"},{"package": {"name": "com.amazonaws:aws-java-sdk-core"},"version": "1.11.415"},{"package": {"name": "bouncycastle:bcmail-jdk14"},"version": "138"},{"package": {"name": "bouncycastle:bcprov-jdk14"},"version": "138"},{"package": {"name": "org.bouncycastle:bcprov-jdk18on"},"version": "1.74"},{"package": {"name": "org.bouncycastle:bctsp-jdk14"},"version": "1.38"},{"package": {"name": "io.zipkin.brave:brave"},"version": "5.16.0"},{"package": {"name": "io.zipkin.aws:brave-propagation-aws"},"version": "0.23.5"},{"package": {"name": "net.bytebuddy:byte-buddy"},"version": "1.14.11"},{"package": {"name": "com.mchange:c3p0"},"version": "0.9.5.5"},{"package": {"name": "commons-codec:commons-codec"},"version": "1.15"},{"package": {"name": "com.chargebee:chargebee-java"},"version": "2.17.0"},{"package": {"name": "org.checkerframework:checker-qual"},"version": "3.41.0"},{"package": {"name": "io.github.classgraph:classgraph"},"version": "4.8.83"},{"package": {"name": "com.fasterxml:classmate"},"version": "1.6.0"},{"package": {"name": "io.netfoundry:common-util-framework"},"version": "3.0.1"},{"package": {"name": "commons-beanutils:commons-beanutils"},"version": "1.9.4"},{"package": {"name": "commons-codec:commons-codec"},"version": "1.16.0"},{"package": {"name": "commons-collections:commons-collections"},"version": "3.2.2"},{"package": {"name": "org.apache.commons:commons-collections4"},"version": "4.4"},{"package": {"name": "commons-digester:commons-digester"},"version": "2.1"},{"package": {"name": "commons-io:commons-io"},"version": "2.11.0"},{"package": {"name": "org.apache.commons:commons-lang3"},"version": "3.13.0"},{"package": {"name": "commons-logging:commons-logging"},"version": "1.2"},{"package": {"name": "org.apache.commons:commons-pool2"},"version": "2.12.0"},{"package": {"name": "commons-validator:commons-validator"},"version": "1.7"},{"package": {"name": "io.micrometer:context-propagation"},"version": "1.1.0"},{"package": {"name": "org.eclipse.jdt:ecj"},"version": "3.21.0"},{"package": {"name": "com.github.bbottema:emailaddress-rfc2822"},"version": "1.1.0"},{"package": {"name": "com.google.errorprone:error_prone_annotations"},"version": "2.23.0"},{"package": {"name": "com.google.guava:failureaccess"},"version": "1.0.2"},{"package": {"name": "org.flywaydb:flyway-core"},"version": "9.22.3"},{"package": {"name": "org.flywaydb:flyway-mysql"},"version": "9.22.3"},{"package": {"name": "com.google.code.gson:gson"},"version": "2.10.1"},{"package": {"name": "com.google.guava:guava"},"version": "33.0.0-jre"},{"package": {"name": "com.h2database:h2"},"version": "2.2.224"},{"package": {"name": "org.hibernate.validator:hibernate-validator"},"version": "8.0.1.Final"},{"package": {"name": "org.apache.httpcomponents:httpclient"},"version": "4.5.5"},{"package": {"name": "org.apache.httpcomponents.client5:httpclient5"},"version": "5.2.3"},{"package": {"name": "org.apache.httpcomponents:httpcore"},"version": "4.4.16"},{"package": {"name": "org.apache.httpcomponents.core5:httpcore5"},"version": "5.2.4"},{"package": {"name": "org.apache.httpcomponents.core5:httpcore5-h2"},"version": "5.2"},{"package": {"name": "software.amazon.ion:ion-java"},"version": "1.0.2"},{"package": {"name": "com.lowagie:itext"},"version": "2.1.7"},{"package": {"name": "com.google.j2objc:j2objc-annotations"},"version": "2.8"},{"package": {"name": "com.fasterxml.jackson.core:jackson-core"},"version": "2.15.3"},{"package": {"name": "com.fasterxml.jackson.core:jackson-databind"},"version": "2.15.3"},{"package": {"name": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor"},"version": "2.15.3"},{"package": {"name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"},"version": "2.15.3"},{"package": {"name": "com.fasterxml.jackson.datatype:jackson-datatype-jsr310"},"version": "2.14.2"},{"package": {"name": "jakarta.activation:jakarta.activation-api"},"version": "2.1.2"},{"package": {"name": "jakarta.annotation:jakarta.annotation-api"},"version": "2.1.1"},{"package": {"name": "jakarta.validation:jakarta.validation-api"},"version": "3.0.2"},{"package": {"name": "jakarta.xml.bind:jakarta.xml.bind-api"},"version": "4.0.1"},{"package": {"name": "net.sf.jasperreports:jasperreports"},"version": "6.20.0"},{"package": {"name": "com.auth0:java-jwt"},"version": "4.4.0"},{"package": {"name": "javax.activation:javax.activation-api"},"version": "1.2.0"},{"package": {"name": "com.sun.mail:javax.mail"},"version": "1.6.2"},{"package": {"name": "org.jboss.logging:jboss-logging"},"version": "3.5.3.Final"},{"package": {"name": "org.slf4j:jcl-over-slf4j"},"version": "2.0.11"},{"package": {"name": "org.jfree:jcommon"},"version": "1.0.23"},{"package": {"name": "redis.clients:jedis"},"version": "5.0.2"},{"package": {"name": "org.jfree:jfreechart"},"version": "1.0.19"},{"package": {"name": "com.amazonaws:jmespath-java"},"version": "1.11.415"},{"package": {"name": "joda-time:joda-time"},"version": "2.8.1"},{"package": {"name": "org.bitbucket.b_c:jose4j"},"version": "0.9.5"},{"package": {"name": "org.json:json"},"version": "20220320"},{"package": {"name": "com.jayway.jsonpath:json-path"},"version": "2.8.0"},{"package": {"name": "net.minidev:json-smart"},"version": "2.5.0"},{"package": {"name": "com.github.jsqlparser:jsqlparser"},"version": "4.6"},{"package": {"name": "com.google.code.findbugs:jsr305"},"version": "3.0.2"},{"package": {"name": "org.slf4j:jul-to-slf4j"},"version": "2.0.11"},{"package": {"name": "com.auth0:jwks-rsa"},"version": "0.22.1"},{"package": {"name": "io.lettuce:lettuce-core"},"version": "6.3.1.RELEASE"},{"package": {"name": "com.google.guava:listenablefuture"},"version": "9999.0-empty-to-avoid-conflict-with-guava"},{"package": {"name": "org.apache.logging.log4j:log4j-api"},"version": "2.21.1"},{"package": {"name": "org.apache.logging.log4j:log4j-to-slf4j"},"version": "2.21.1"},{"package": {"name": "ch.qos.logback:logback-core"},"version": "1.4.14"},{"package": {"name": "net.logstash.logback:logstash-logback-encoder"},"version": "7.4"},{"package": {"name": "org.projectlombok:lombok"},"version": "1.18.30"},{"package": {"name": "org.mapstruct:mapstruct"},"version": "1.3.1.Final"},{"package": {"name": "com.mchange:mchange-commons-java"},"version": "0.2.15"},{"package": {"name": "io.netfoundry:messaging-framework"},"version": "0.8.0"},{"package": {"name": "io.dropwizard.metrics:metrics-core"},"version": "4.2.23"},{"package": {"name": "io.dropwizard.metrics:metrics-jmx"},"version": "4.2.23"},{"package": {"name": "io.micrometer:micrometer-commons"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-core"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-jakarta9"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-observation"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-registry-elastic"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-registry-jmx"},"version": "1.12.2"},{"package": {"name": "io.micrometer:micrometer-tracing"},"version": "1.2.2"},{"package": {"name": "io.micrometer:micrometer-tracing-bridge-brave"},"version": "1.2.2"},{"package": {"name": "net.bytebuddy:byte-buddy-dep"},"version": "1.12.3"},{"package": {"name": "net.jodah:typetools"},"version": "0.6.3"},{"package": {"name": "org.modelmapper:modelmapper"},"version": "3.1.1"},{"package": {"name": "com.mysql:mysql-connector-j"},"version": "8.0.32"},{"package": {"name": "org.jctools:jctools-core"},"version": "3.1.0"},{"package": {"name": "io.netty:netty-transport"},"version": "4.1.105.Final"},{"package": {"name": "org.reactivestreams:reactive-streams"},"version": "1.0.4"},{"package": {"name": "io.projectreactor:reactor-core"},"version": "3.6.2"},{"package": {"name": "org.mozilla:rhino"},"version": "1.7.14"},{"package": {"name": "com.vdurmont:semver4j"},"version": "3.1.0"},{"package": {"name": "net.javacrumbs.shedlock:shedlock-core"},"version": "4.33.0"},{"package": {"name": "net.javacrumbs.shedlock:shedlock-provider-jdbc-template"},"version": "4.33.0"},{"package": {"name": "net.javacrumbs.shedlock:shedlock-provider-redis-spring"},"version": "4.33.0"},{"package": {"name": "net.javacrumbs.shedlock:shedlock-spring"},"version": "4.33.0"},{"package": {"name": "org.simplejavamail:outlook-message-parser"},"version": "1.1.16"},{"package": {"name": "org.simplejavamail:simple-java-mail"},"version": "5.0.1"},{"package": {"name": "org.slf4j:slf4j-api"},"version": "2.0.11"},{"package": {"name": "org.yaml:snakeyaml"},"version": "2.2"},{"package": {"name": "org.springframework.amqp:spring-amqp"},"version": "3.1.1"},{"package": {"name": "org.springframework.batch:spring-batch-core"},"version": "5.1.0"},{"package": {"name": "org.springframework.boot:spring-boot"},"version": "3.2.2"},{"package": {"name": "org.springframework.boot:spring-boot-starter-web"},"version": "3.2.2"},{"package": {"name": "org.springframework.cloud:spring-cloud-aws-autoconfigure"},"version": "2.1.3.RELEASE"},{"package": {"name": "org.springframework.cloud:spring-cloud-aws-context"},"version": "2.1.3.RELEASE"},{"package": {"name": "org.springframework.cloud:spring-cloud-aws-core"},"version": "2.1.3.RELEASE"},{"package": {"name": "org.springframework.cloud:spring-cloud-aws-messaging"},"version": "2.1.3.RELEASE"},{"package": {"name": "org.springframework.cloud:spring-cloud-commons"},"version": "4.1.0"},{"package": {"name": "org.springframework.cloud:spring-cloud-config-client"},"version": "4.1.0"},{"package": {"name": "org.springframework.cloud:spring-cloud-context"},"version": "4.1.0"},{"package": {"name": "org.springframework.cloud:spring-cloud-starter"},"version": "4.1.0"},{"package": {"name": "org.springframework.cloud:spring-cloud-starter-aws"},"version": "2.1.3.RELEASE"},{"package": {"name": "org.springframework:spring-core"},"version": "6.1.3"},{"package": {"name": "org.springframework.data:spring-data-commons"},"version": "3.2.2"},{"package": {"name": "org.springframework.data:spring-data-jdbc"},"version": "3.2.2"},{"package": {"name": "org.springframework.data:spring-data-keyvalue"},"version": "3.2.2"},{"package": {"name": "org.springframework.data:spring-data-redis"},"version": "3.2.2"},{"package": {"name": "org.springframework.data:spring-data-relational"},"version": "3.2.2"},{"package": {"name": "org.springframework.hateoas:spring-hateoas"},"version": "2.2.0"},{"package": {"name": "org.springframework.plugin:spring-plugin-core"},"version": "2.0.0.RELEASE"},{"package": {"name": "org.springframework.plugin:spring-plugin-metadata"},"version": "2.0.0.RELEASE"},{"package": {"name": "org.springframework.retry:spring-retry"},"version": "2.0.5"},{"package": {"name": "org.springframework.security:spring-security-crypto"},"version": "6.2.1"},{"package": {"name": "org.springframework.security:spring-security-rsa"},"version": "1.1.1"},{"package": {"name": "org.springframework:spring-web"},"version": "6.1.3"},{"package": {"name": "org.springdoc:springdoc-openapi-starter-common"},"version": "2.1.0"},{"package": {"name": "org.springdoc:springdoc-openapi-starter-webmvc-api"},"version": "2.1.0"},{"package": {"name": "org.springdoc:springdoc-openapi-starter-webmvc-ui"},"version": "2.1.0"},{"package": {"name": "io.springfox:springfox-core"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-schema"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-spi"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-spring-web"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-spring-webflux"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-spring-webmvc"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-swagger-common"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-swagger-ui"},"version": "3.0.0"},{"package": {"name": "io.springfox:springfox-swagger2"},"version": "3.0.0"},{"package": {"name": "org.codehaus.woodstox:stax2-api"},"version": "4.2.1"},{"package": {"name": "net.sf.supercsv:super-csv"},"version": "2.4.0"},{"package": {"name": "io.swagger:swagger-annotations"},"version": "1.5.20"},{"package": {"name": "io.swagger.core.v3:swagger-annotations"},"version": "2.1.2"},{"package": {"name": "io.swagger.core.v3:swagger-core-jakarta"},"version": "2.2.9"},{"package": {"name": "io.swagger:swagger-models"},"version": "1.5.20"},{"package": {"name": "org.webjars:swagger-ui"},"version": "4.18.2"},{"package": {"name": "org.apache.tomcat.embed:tomcat-embed-core"},"version": "10.1.18"},{"package": {"name": "org.apache.tomcat.embed:tomcat-embed-el"},"version": "10.1.18"},{"package": {"name": "com.sun.xml.bind.jaxb:isorelax"},"version": "20090621"},{"package": {"name": "net.java.dev.msv:xsdlib"},"version": "2013.6.1"},{"package": {"name": "com.fasterxml.woodstox:woodstox-core"},"version": "6.5.1"}]}],"remediations": [] }