Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
* indicates the dependency has a known exploited vulnerability
Dependencies
aspectjrt-1.9.19.jar
Description:
The AspectJ runtime is a small library necessary to run Java programs enhanced by AspectJ aspects during a previous
compile-time or post-compile-time (binary weaving) build step.
License:
Eclipse Public License - v 2.0: https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/aspectj/aspectjrt/1.9.19/aspectjrt-1.9.19.jar MD5: 249f23aacbb08a0b4ab60fd92c9ef1e8 SHA1: d6d4ccdb1318b19c85e8c1c2227941c32a4253a9 SHA256:87fcab9b5f01a2bbddc13db7b439bd55a786f85bfac4872d25c911c91e23c45b Referenced In Project/Scope: SteelBlue - Examples - Backend:compile aspectjrt-1.9.19.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role-spring@3.2-ALPHA-23
Roles are a powerful way for designing complex behaviours while keeping good practices such as Single Responsibility, Dependency Inversion and
Interface Segregation.
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role/3.2-ALPHA-23/it-tidalwave-role-3.2-ALPHA-23.jar MD5: 37f0daee422c452ebe1a056f3e33d566 SHA1: afcce55ee9a0a52285c6ab13a6f61c4e8f667db7 SHA256:dc43792db69cb53f1341d33d8517ef99c45ce356f55b105227f532c8012e7bd9 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile it-tidalwave-role-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-steelblue-example-backend@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role-spring/3.2-ALPHA-23/it-tidalwave-role-spring-3.2-ALPHA-23.jar MD5: d4e8a6e066a85ae7c1ca3160a7a2adc5 SHA1: 01a4d2eeb24af26554e446c92bfa4b6f15f2b143 SHA256:f0fef53724188d02337986f072ef6b0d1bf4a991a177cfbdf4ff9f756193335b Referenced In Project/Scope: SteelBlue - Examples - Backend:compile it-tidalwave-role-spring-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-steelblue-example-backend@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-util/3.2-ALPHA-23/it-tidalwave-util-3.2-ALPHA-23.jar MD5: 021b41e778533aa2700c52873b0b0b75 SHA1: 1ed40423e696ec50058f9c3ccb3a468c05fcb5cf SHA256:4fea0bf9e195da5db90a3b675562dcdbfe98a058e04e324c846f31d6991e3327 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile it-tidalwave-util-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-steelblue-example-backend@1.1-ALPHA-3
CDDL + GPLv2 with classpath exception: https://github.com/javaee/javax.annotation/blob/master/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/annotation/javax.annotation-api/1.3.2/javax.annotation-api-1.3.2.jar MD5: 2ab1973eefffaa2aeec47d50b9e40b9d SHA1: 934c04d3cfef185a8008e7bf34331b79730a9d43 SHA256:e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b Referenced In Project/Scope: SteelBlue - Examples - Backend:compile javax.annotation-api-1.3.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-23
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/inject/javax.inject/1/javax.inject-1.jar MD5: 289075e48b909e9e74e6c915b3631d2e SHA1: 6975da39a7040257bd51d21a231b76c915872d38 SHA256:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff Referenced In Project/Scope: SteelBlue - Examples - Backend:compile javax.inject-1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role-spring@3.2-ALPHA-23
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar MD5: dd83accb899363c32b07d7a1b2e4ce40 SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-23
Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!
License:
The MIT License: https://projectlombok.org/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar MD5: a1651eaa9c999c61131d32feab16fcde SHA1: 13a394eed5c4f9efb2a6d956e2086f1d81e857d9 SHA256:d3584bc2db03f059f984fb0a9c119aac1fa0da578a448e69fc3f68b36584c749 Referenced In Project/Scope: SteelBlue - Examples - Backend:provided lombok-1.18.24.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-steelblue-example-backend@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar MD5: 403dffa46cdd2e3c82da19df4f394a4c SHA1: 41eb7184ea9d556f23e18b5cb99cad1f8581fc00 SHA256:5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile slf4j-api-2.0.7.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-23
GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/github/spotbugs/spotbugs-annotations/3.1.9/spotbugs-annotations-3.1.9.jar MD5: 56a1a81d69b6a111161bbce0e6dea26a SHA1: 2ef5127efcc1a899aab8c66d449a631c9a99c469 SHA256:68c7c46b4299e94837e236ae742f399901a950fe910fe3ca710026753b5dd2e1 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile spotbugs-annotations-3.1.9.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-23
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar MD5: e34fafcb6ea7a2c9db80a686af31a27e SHA1: b255bb7389e582d24574f75bc0c880ffb8103dfa SHA256:94a64b38e9dfa22df3c67664aea08aed559110bed386a736cb02a01d0254b236 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile spring-core-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework/spring-beans@4.3.30.RELEASE
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar MD5: e9959f3eadbef7006c2721f27b324627 SHA1: 6ce0709c6899dde41a7213ccccfe2535e34c80fe SHA256:21f6d95c15e1b93675b958c69cd9309754c6909dd25c01f120a3934de7e37749 Referenced In Project/Scope: SteelBlue - Examples - Backend:compile spring-expression-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role-spring@3.2-ALPHA-23
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2024-38808 for details
CWE-770 Allocation of Resources Without Limits or Throttling