community icon indicating copy to clipboard operation
community copied to clipboard
verified publisher icon logicaldoc

Dependency org.apache.httpcomponents:httpclient, leading to CVE problem

Open CVEDetect opened this issue 3 years ago • 0 comments

Hi, In /logicaldoc-webservicesamples，there is a dependency org.apache.httpcomponents:httpclient:4.5.2 that calls the risk method.

CVE-2020-13956

The scope of this CVE affected version is [,4.5.13)

After further analysis, in this project, the main Api called is org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

com.logicaldoc.webservicesamples.RestJodConverter: addPartMethod01()V /.m2/repository/org/bytedeco/javacpp-presets/ffmpeg/4.0.2-1.4.3/ffmpeg-4.0.2-1.4.3-android-arm.jar
org.apache.http.impl.client.CloseableHttpClient: execute(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.client.methods.CloseableHttpResponse; /.m2/repository/org/bytedeco/javacpp-presets/ffmpeg/4.0.2-1.4.3/ffmpeg-4.0.2-1.4.3-android-arm.jar
org.apache.http.impl.client.CloseableHttpClient: execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.protocol.HttpContext)Lorg.apache.http.client.methods.CloseableHttpResponse; /.m2/repository/org/bytedeco/javacpp-presets/ffmpeg/4.0.2-1.4.3/ffmpeg-4.0.2-1.4.3-android-arm.jar
org.apache.http.impl.client.CloseableHttpClient: determineTarget(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.HttpHost; /.m2/repository/org/bytedeco/javacpp-presets/ffmpeg/4.0.2-1.4.3/ffmpeg-4.0.2-1.4.3-android-arm.jar
org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost;

Dependency tree--

[INFO] com.logicaldoc:logicaldoc-webservicesamples:jar:8.8.2
[INFO] +- com.logicaldoc:logicaldoc-webservice:jar:8.8.2:compile
[INFO] |  +- io.swagger.core.v3:swagger-annotations:jar:2.2.2:compile
[INFO] |  +- org.apache.cxf:cxf-rt-frontend-jaxrs:jar:3.5.2:compile
[INFO] |  |  +- org.apache.cxf:cxf-core:jar:3.5.2:compile
[INFO] |  |  |  +- org.glassfish.jaxb:jaxb-runtime:jar:2.3.5:compile
[INFO] |  |  |  |  +- org.glassfish.jaxb:txw2:jar:2.3.5:compile
[INFO] |  |  |  |  \- com.sun.istack:istack-commons-runtime:jar:3.0.12:compile
[INFO] |  |  |  \- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:compile
[INFO] |  |  +- jakarta.ws.rs:jakarta.ws.rs-api:jar:2.1.6:compile
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-security:jar:3.5.2:compile
[INFO] |  |  +- jakarta.xml.ws:jakarta.xml.ws-api:jar:2.3.3:compile
[INFO] |  |  +- jakarta.jws:jakarta.jws-api:jar:2.1.0:compile
[INFO] |  |  +- jakarta.xml.soap:jakarta.xml.soap-api:jar:1.4.2:compile
[INFO] |  |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.2:compile
[INFO] |  |  +- com.sun.activation:jakarta.activation:jar:1.2.2:compile
[INFO] |  |  +- com.sun.xml.messaging.saaj:saaj-impl:jar:1.5.3:runtime
[INFO] |  |  |  \- org.jvnet.staxex:stax-ex:jar:1.8.3:runtime
[INFO] |  |  \- org.apache.geronimo.specs:geronimo-jta_1.1_spec:jar:1.1.1:compile
[INFO] |  +- org.apache.cxf:cxf-rt-frontend-jaxws:jar:3.5.2:compile
[INFO] |  |  +- xml-resolver:xml-resolver:jar:1.2:compile
[INFO] |  |  +- org.ow2.asm:asm:jar:9.3:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-bindings-soap:jar:3.5.2:compile
[INFO] |  |  |  +- org.apache.cxf:cxf-rt-wsdl:jar:3.5.2:compile
[INFO] |  |  |  |  \- wsdl4j:wsdl4j:jar:1.6.3:compile
[INFO] |  |  |  \- org.apache.cxf:cxf-rt-databinding-jaxb:jar:3.5.2:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.5.2:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-frontend-simple:jar:3.5.2:compile
[INFO] |  |  \- org.apache.cxf:cxf-rt-ws-addr:jar:3.5.2:compile
[INFO] |  |     \- org.apache.cxf:cxf-rt-ws-policy:jar:3.5.2:compile
[INFO] |  |        \- org.apache.neethi:neethi:jar:3.2.0:compile
[INFO] |  +- org.apache.cxf:cxf-rt-rs-service-description:jar:3.5.2:compile
[INFO] |  +- org.apache.cxf:cxf-rt-rs-client:jar:3.5.2:compile
[INFO] |  +- org.apache.cxf:cxf-rt-transports-http:jar:3.5.2:compile
[INFO] |  +- org.apache.cxf:cxf-rt-features-logging:jar:3.5.2:compile
[INFO] |  +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
[INFO] |  |  \- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] |  +- org.codehaus.jettison:jettison:jar:1.3.7:compile
[INFO] |  |  \- stax:stax-api:jar:1.0.1:compile
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.2:compile
[INFO] |  |  \- org.apache.httpcomponents:httpcore:jar:4.4.4:compile
[INFO] |  +- org.apache.httpcomponents:httpmime:jar:4.5.2:compile
[INFO] |  +- org.apache.commons:commons-lang3:jar:3.5:compile
[INFO] |  +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.12.7:compile
[INFO] |  |  +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.12.7:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.12.7:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.12.7:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:compile
[INFO] |  +- javax.ws.rs:javax.ws.rs-api:jar:2.1.1:compile
[INFO] |  +- org.apache.ws.xmlschema:xmlschema-core:jar:2.2.1:compile
[INFO] |  +- org.freemarker:freemarker:jar:2.3.15:compile
[INFO] |  +- javax.xml.ws:jaxws-api:jar:2.3.1:compile
[INFO] |  |  +- javax.xml.bind:jaxb-api:jar:2.2.11:compile
[INFO] |  |  +- javax.xml.soap:javax.xml.soap-api:jar:1.4.0:compile
[INFO] |  |  \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  \- org.glassfish:javax.jws:jar:3.1.1:compile
[INFO] +- com.logicaldoc:logicaldoc-core:jar:8.8.2:compile
[INFO] |  +- org.apache.commons:commons-collections4:jar:4.1:compile
[INFO] |  +- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] |  +- org.apache.commons:commons-compress:jar:1.21:compile
[INFO] |  +- org.tukaani:xz:jar:1.5:compile
[INFO] |  +- net.lingala.zip4j:zip4j:jar:2.11.1:compile
[INFO] |  +- commons-codec:commons-codec:jar:1.13:compile
[INFO] |  +- org.apache.poi:poi:jar:3.16:compile
[INFO] |  +- org.apache.poi:poi-scratchpad:jar:3.16:compile
[INFO] |  +- org.apache.poi:poi-ooxml:jar:3.16:compile
[INFO] |  |  +- org.apache.poi:poi-ooxml-schemas:jar:3.16:compile
[INFO] |  |  \- com.github.virtuald:curvesapi:jar:1.04:compile
[INFO] |  +- org.apache.xmlbeans:xmlbeans:jar:3.1.0:compile
[INFO] |  +- org.hibernate:hibernate-ehcache:jar:5.2.12.Final:compile
[INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.3.0.Final:compile
[INFO] |  |  +- org.hibernate:hibernate-core:jar:5.2.12.Final:compile
[INFO] |  |  |  +- org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
[INFO] |  |  |  +- org.javassist:javassist:jar:3.20.0-GA:compile
[INFO] |  |  |  +- antlr:antlr:jar:2.7.7:compile
[INFO] |  |  |  +- org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:jar:1.0.1.Final:compile
[INFO] |  |  |  +- org.jboss:jandex:jar:2.0.3.Final:compile
[INFO] |  |  |  +- com.fasterxml:classmate:jar:1.3.0:compile
[INFO] |  |  |  +- dom4j:dom4j:jar:1.6.1:compile
[INFO] |  |  |  \- org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
[INFO] |  |  \- net.sf.ehcache:ehcache:jar:2.10.3:compile
[INFO] |  +- net.sf.ehcache.internal:ehcache-core:jar:2.10.9.2:compile
[INFO] |  |  \- org.terracotta.internal:statistics:jar:1.0.5:compile
[INFO] |  +- org.quartz-scheduler:quartz:jar:2.3.2:compile
[INFO] |  |  +- com.mchange:c3p0:jar:0.9.5.4:compile
[INFO] |  |  +- com.mchange:mchange-commons-java:jar:0.2.15:compile
[INFO] |  |  \- com.zaxxer:HikariCP-java7:jar:2.4.13:compile
[INFO] |  +- org.quartz-scheduler:quartz-jobs:jar:2.3.2:compile
[INFO] |  +- net.sourceforge.nekohtml:nekohtml:jar:1.9.7:compile
[INFO] |  |  \- xerces:xercesImpl:jar:2.8.1:compile
[INFO] |  |     \- xml-apis:xml-apis:jar:1.3.04:compile
[INFO] |  +- org.apache.pdfbox:pdfbox:jar:2.0.24:compile
[INFO] |  |  \- org.apache.pdfbox:fontbox:jar:2.0.24:compile
[INFO] |  +- org.apache.pdfbox:pdfbox-tools:jar:2.0.24:compile
[INFO] |  |  \- org.apache.pdfbox:pdfbox-debugger:jar:2.0.24:compile
[INFO] |  +- com.ibm.icu:icu4j:jar:71.1:compile
[INFO] |  +- org.apache.lucene:lucene-core:jar:8.11.1:compile
[INFO] |  +- org.apache.lucene:lucene-highlighter:jar:8.11.1:compile
[INFO] |  |  \- org.apache.lucene:lucene-queries:jar:8.11.1:compile
[INFO] |  +- org.apache.lucene:lucene-misc:jar:8.11.1:compile
[INFO] |  +- org.apache.lucene:lucene-analyzers-common:jar:8.11.1:compile
[INFO] |  +- org.apache.lucene:lucene-memory:jar:8.11.1:compile
[INFO] |  +- org.apache.solr:solr-core:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-analyzers-kuromoji:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-analyzers-nori:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-analyzers-phonetic:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-backward-codecs:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-classification:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-codecs:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-expressions:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-grouping:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-join:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-queryparser:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-sandbox:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-spatial-extras:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-spatial3d:jar:8.11.1:compile
[INFO] |  |  +- org.apache.lucene:lucene-suggest:jar:8.11.1:compile
[INFO] |  |  +- com.carrotsearch:hppc:jar:0.8.1:compile
[INFO] |  |  +- com.esri.geometry:esri-geometry-api:jar:2.2.0:compile
[INFO] |  |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar:2.12.3:compile
[INFO] |  |  +- com.fasterxml.woodstox:woodstox-core:jar:6.2.4:compile
[INFO] |  |  +- com.github.ben-manes.caffeine:caffeine:jar:2.9.2:compile
[INFO] |  |  +- com.github.zafarkhaja:java-semver:jar:0.9.0:compile
[INFO] |  |  +- com.google.guava:guava:jar:31.1-jre:compile
[INFO] |  |  |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] |  |  |  \- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  |  +- com.google.protobuf:protobuf-java:jar:3.11.0:compile
[INFO] |  |  +- com.google.re2j:re2j:jar:1.2:compile
[INFO] |  |  +- com.jayway.jsonpath:json-path:jar:2.4.0:compile
[INFO] |  |  +- com.lmax:disruptor:jar:3.4.2:compile
[INFO] |  |  +- com.tdunning:t-digest:jar:3.1:compile
[INFO] |  |  +- commons-cli:commons-cli:jar:1.1:compile
[INFO] |  |  +- commons-lang:commons-lang:jar:2.4:compile
[INFO] |  |  +- io.dropwizard.metrics:metrics-graphite:jar:4.1.5:compile
[INFO] |  |  +- io.dropwizard.metrics:metrics-jetty9:jar:4.1.5:compile
[INFO] |  |  +- io.dropwizard.metrics:metrics-jmx:jar:4.1.5:compile
[INFO] |  |  +- io.dropwizard.metrics:metrics-jvm:jar:4.1.5:compile
[INFO] |  |  +- io.netty:netty-buffer:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-codec:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-common:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-handler:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-resolver:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-transport:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-transport-native-epoll:jar:4.1.68.Final:compile
[INFO] |  |  +- io.netty:netty-transport-native-unix-common:jar:4.1.68.Final:compile
[INFO] |  |  +- io.opentracing:opentracing-api:jar:0.33.0:compile
[INFO] |  |  +- io.opentracing:opentracing-noop:jar:0.33.0:compile
[INFO] |  |  +- io.opentracing:opentracing-util:jar:0.33.0:compile
[INFO] |  |  +- io.sgr:s2-geometry-library-java:jar:1.0.0:compile
[INFO] |  |  +- javax.servlet:javax.servlet-api:jar:3.1.0:compile
[INFO] |  |  +- net.hydromatic:eigenbase-properties:jar:1.1.5:compile
[INFO] |  |  +- org.antlr:antlr4-runtime:jar:4.5.1-1:compile
[INFO] |  |  +- org.apache.calcite:calcite-core:jar:1.27.0:compile
[INFO] |  |  +- org.apache.calcite:calcite-linq4j:jar:1.27.0:compile
[INFO] |  |  +- org.apache.calcite.avatica:avatica-core:jar:1.18.0:compile
[INFO] |  |  +- org.apache.commons:commons-configuration2:jar:2.1.1:compile
[INFO] |  |  +- org.apache.commons:commons-exec:jar:1.3:compile
[INFO] |  |  +- org.apache.commons:commons-math3:jar:3.6.1:compile
[INFO] |  |  +- org.apache.commons:commons-text:jar:1.6:compile
[INFO] |  |  +- org.apache.curator:curator-client:jar:2.13.0:compile
[INFO] |  |  +- org.apache.curator:curator-framework:jar:2.13.0:compile
[INFO] |  |  +- org.apache.curator:curator-recipes:jar:2.13.0:compile
[INFO] |  |  +- org.apache.hadoop:hadoop-annotations:jar:3.2.2:compile
[INFO] |  |  +- org.apache.hadoop:hadoop-auth:jar:3.2.2:compile
[INFO] |  |  +- org.apache.hadoop:hadoop-common:jar:3.2.2:compile
[INFO] |  |  +- org.apache.hadoop:hadoop-hdfs-client:jar:3.2.2:compile
[INFO] |  |  +- org.apache.htrace:htrace-core4:jar:4.1.0-incubating:compile
[INFO] |  |  +- org.apache.kerby:kerb-core:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerb-util:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerby-asn1:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerby-pkix:jar:1.0.1:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-layout-template-json:jar:2.16.0:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-web:jar:2.16.0:compile
[INFO] |  |  +- org.apache.zookeeper:zookeeper:jar:3.6.2:compile
[INFO] |  |  +- org.apache.zookeeper:zookeeper-jute:jar:3.6.2:compile
[INFO] |  |  +- org.apiguardian:apiguardian-api:jar:1.1.0:compile
[INFO] |  |  +- org.bitbucket.b_c:jose4j:jar:0.6.5:compile
[INFO] |  |  +- org.checkerframework:checker-qual:jar:3.10.0:compile
[INFO] |  |  +- org.codehaus.janino:commons-compiler:jar:3.0.9:compile
[INFO] |  |  +- org.codehaus.janino:janino:jar:3.0.9:compile
[INFO] |  |  +- org.codehaus.woodstox:stax2-api:jar:4.2.1:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-client:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-java-client:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-client:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-continuation:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-deploy:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-http:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-io:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-jmx:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-rewrite:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-security:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-server:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-servlet:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-servlets:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-util:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-webapp:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-xml:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-client:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-common:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-hpack:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-http-client-transport:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-server:jar:9.4.44.v20210927:compile
[INFO] |  |  +- org.locationtech.spatial4j:spatial4j:jar:0.7:compile
[INFO] |  |  +- org.ow2.asm:asm-commons:jar:8.0.1:compile
[INFO] |  |  +- org.rrd4j:rrd4j:jar:3.5:compile
[INFO] |  |  \- org.xerial.snappy:snappy-java:jar:1.1.7.6:compile
[INFO] |  +- org.apache.solr:solr-solrj:jar:8.11.1:compile
[INFO] |  +- org.apache.solr:solr-velocity:jar:8.11.1:compile
[INFO] |  |  +- org.apache.velocity:velocity-engine-core:jar:2.2:compile
[INFO] |  |  +- org.apache.velocity.tools:velocity-tools-generic:jar:3.1:compile
[INFO] |  |  +- org.apache.velocity.tools:velocity-tools-view:jar:3.1:compile
[INFO] |  |  +- org.apache.velocity.tools:velocity-tools-view-jsp:jar:3.1:compile
[INFO] |  |  \- org.slf4j:jcl-over-slf4j:jar:1.7.24:compile
[INFO] |  +- io.dropwizard.metrics:metrics-core:jar:3.2.6:compile
[INFO] |  +- net.sf.jmimemagic:jmimemagic:jar:0.1.5:compile
[INFO] |  +- javax.media:jai-core:jar:1.1.3:compile
[INFO] |  +- com.sun.media:jai-codec:jar:1.1.3:compile
[INFO] |  +- com.auxilii.msgparser:msgparser:jar:1.1.15:compile
[INFO] |  +- com.mpatric:mp3agic:jar:0.9.1:compile
[INFO] |  +- org.bytedeco:javacv-platform:jar:1.4.3:compile
[INFO] |  |  +- org.bytedeco:javacv:jar:1.4.3:compile
[INFO] |  |  |  +- org.bytedeco:javacpp:jar:1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:3.4.3-1.4.3:compile
[INFO] |  |  |  \- org.bytedeco.javacpp-presets:ffmpeg:jar:4.0.2-1.4.3:compile
[INFO] |  |  +- org.bytedeco.javacpp-presets:opencv-platform:jar:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:android-arm:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:android-arm64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:android-x86:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:android-x86_64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:ios-arm64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:ios-x86_64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:linux-x86:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:linux-x86_64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:linux-armhf:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:linux-ppc64le:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:macosx-x86_64:3.4.3-1.4.3:compile
[INFO] |  |  |  +- org.bytedeco.javacpp-presets:opencv:jar:windows-x86:3.4.3-1.4.3:compile
[INFO] |  |  |  \- org.bytedeco.javacpp-presets:opencv:jar:windows-x86_64:3.4.3-1.4.3:compile
[INFO] |  |  \- org.bytedeco.javacpp-presets:ffmpeg-platform:jar:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:android-arm:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:android-arm64:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:android-x86:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:android-x86_64:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:linux-x86:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:linux-x86_64:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:linux-armhf:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:linux-ppc64le:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:macosx-x86_64:4.0.2-1.4.3:compile
[INFO] |  |     +- org.bytedeco.javacpp-presets:ffmpeg:jar:windows-x86:4.0.2-1.4.3:compile
[INFO] |  |     \- org.bytedeco.javacpp-presets:ffmpeg:jar:windows-x86_64:4.0.2-1.4.3:compile
[INFO] |  +- com.github.mertakdut:EpubParser:jar:1.0.95:compile
[INFO] |  +- eu.bitwalker:UserAgentUtils:jar:1.21:compile
[INFO] |  +- com.maxmind.geoip2:geoip2:jar:2.15.0:compile
[INFO] |  |  \- com.maxmind.db:maxmind-db:jar:2.0.0:compile
[INFO] |  +- com.timgroup:jgravatar:jar:1.2:compile
[INFO] |  \- com.talanlabs:avatar-generator:jar:1.1.0:compile
[INFO] |     \- com.jhlabs:filters:jar:2.0.235-1:compile
[INFO] +- com.logicaldoc:logicaldoc-util:jar:8.8.2:compile
[INFO] |  +- org.bouncycastle:bcmail-jdk16:jar:1.46:compile
[INFO] |  +- org.bouncycastle:bcprov-jdk16:jar:1.46:compile
[INFO] |  +- org.bouncycastle:bcprov-ext-jdk16:jar:1.46:compile
[INFO] |  +- org.jsoup:jsoup:jar:1.15.2:compile
[INFO] |  +- jaxen:jaxen:jar:1.2.0:compile
[INFO] |  +- org.passay:passay:jar:1.6.2:compile
[INFO] |  +- com.github.junrar:junrar:jar:7.5.3:compile
[INFO] |  +- org.apache.logging.log4j:log4j-api:jar:2.17.2:compile
[INFO] |  \- org.apache.logging.log4j:log4j-core:jar:2.17.2:compile
[INFO] +- commons-io:commons-io:jar:2.11.0:compile
[INFO] +- junit:junit:jar:4.6:test
[INFO] +- org.slf4j:slf4j-api:jar:1.7.32:provided
[INFO] +- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.17.2:provided
[INFO] \- javax.activation:activation:jar:1.1.1:compile

Suggested solutions:

Update dependency version

Thank you very much.

CVEDetect avatar Oct 09 '22 11:10 CVEDetect