Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 6.1.5
Report Generated On: Fri, 2 Apr 2021 06:02:07 GMT
Dependencies Scanned: 4 (4 unique)
Vulnerable Dependencies: 0
Vulnerabilities Found: 0
Vulnerabilities Suppressed: 0
...
NVD CVE Checked: 2021-04-02T06:00:49
NVD CVE Modified: 2021-04-02T05:02:19
VersionCheckOn: 2021-04-02T06:00:49

Summary

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	Vulnerability IDs	Package	Confidence	Evidence Count
commons-lang3-3.8.1.jar		pkg:maven/org.apache.commons/commons-lang3@3.8.1		42
lombok-1.18.20.jar		pkg:maven/org.projectlombok/lombok@1.18.20		24
plexus-build-api-0.0.7.jar		pkg:maven/org.sonatype.plexus/plexus-build-api@0.0.7		26
plexus-utils-3.2.1.jar	cpe:2.3:a:plexus-utils_project:plexus-utils:3.2.1:::::::*	pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1	Highest	27

Dependencies

commons-lang3-3.8.1.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar
MD5: 540b1256d887a6993ecbef23371a3302
SHA1: 6505a72a097d9270f7a9e7bf42c4238283247755
SHA256:dac807f65b07698ff39b1b07bfef3d87ae3fd46d91bbf8a2bc02b2a831616f68
Referenced In Project/Scope:Lombok Maven Plugin:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	lang3	Highest
Vendor	Manifest	bundle-docurl	http://commons.apache.org/proper/commons-lang/	Low
Vendor	Manifest	Implementation-Vendor-Id	org.apache.commons	Medium
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	file	name	commons-lang3	High
Vendor	pom	groupid	apache.commons	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.commons.lang3	Medium
Vendor	pom	name	Apache Commons Lang	High
Vendor	pom	groupid	org.apache.commons	Highest
Vendor	Manifest	automatic-module-name	org.apache.commons.lang3	Medium
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))"	Low
Vendor	Manifest	implementation-url	http://commons.apache.org/proper/commons-lang/	Low
Vendor	pom	artifactid	commons-lang3	Low
Vendor	pom	url	http://commons.apache.org/proper/commons-lang/	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	apache	Highest
Product	jar	package name	lang3	Highest
Product	Manifest	bundle-docurl	http://commons.apache.org/proper/commons-lang/	Low
Product	pom	url	http://commons.apache.org/proper/commons-lang/	Medium
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	artifactid	commons-lang3	Highest
Product	file	name	commons-lang3	High
Product	Manifest	specification-title	Apache Commons Lang	Medium
Product	pom	groupid	apache.commons	Highest
Product	Manifest	bundle-symbolicname	org.apache.commons.lang3	Medium
Product	pom	name	Apache Commons Lang	High
Product	Manifest	automatic-module-name	org.apache.commons.lang3	Medium
Product	Manifest	Bundle-Name	Apache Commons Lang	Medium
Product	Manifest	Implementation-Title	Apache Commons Lang	High
Product	pom	parent-groupid	org.apache.commons	Medium
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))"	Low
Product	Manifest	implementation-url	http://commons.apache.org/proper/commons-lang/	Low
Version	Manifest	Implementation-Version	3.8.1	High
Version	Manifest	Bundle-Version	3.8.1	High
Version	pom	version	3.8.1	Highest
Version	pom	parent-version	3.8.1	Low
Version	file	version	3.8.1	High

Identifiers

pkg:maven/org.apache.commons/commons-lang3@3.8.1 (Confidence:High)

lombok-1.18.20.jar

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: /home/runner/.m2/repository/org/projectlombok/lombok/1.18.20/lombok-1.18.20.jar
MD5: e863b4be4fe03d2da763679ba1a9079b
SHA1: 18bcea7d5df4d49227b4a0743a536208ce4825bb
SHA256:ce947be6c2fbe759fbbe8ef3b42b6825f814c98c8853f1013f2d9630cedf74b0
Referenced In Project/Scope:Lombok Maven Plugin:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	pom	name	Project Lombok	High
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	jar	package name	tostring	Highest
Vendor	jar	package name	lombok	Highest
Vendor	pom	groupid	projectlombok	Highest
Vendor	jar	package name	java	Highest
Vendor	file	name	lombok	High
Vendor	pom	artifactid	lombok	Low
Vendor	pom	url	https://projectlombok.org	Highest
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Product	pom	name	Project Lombok	High
Product	Manifest	can-redefine-classes	true	Low
Product	jar	package name	tostring	Highest
Product	jar	package name	lombok	Highest
Product	pom	artifactid	lombok	Highest
Product	pom	groupid	projectlombok	Highest
Product	jar	package name	java	Highest
Product	file	name	lombok	High
Product	pom	url	https://projectlombok.org	Medium
Product	Manifest	automatic-module-name	lombok	Medium
Version	pom	version	1.18.20	Highest
Version	Manifest	lombok-version	1.18.20	Medium
Version	file	version	1.18.20	High

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.20 (Confidence:High)

plexus-build-api-0.0.7.jar

File Path: /home/runner/.m2/repository/org/sonatype/plexus/plexus-build-api/0.0.7/plexus-build-api-0.0.7.jar
MD5: 49f0f8c6bdf2687e358870a4fc1559c6
SHA1: e6ba5cd4bfd8de00235af936e7f63eb24ed436e6
SHA256:934171640fbd3d2495c50b79b0d9adb11e2c83e65bad157df8fe34bcac0ff798
Referenced In Project/Scope:Lombok Maven Plugin:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	sonatype	Highest
Vendor	pom	parent-groupid	org.sonatype.spice	Medium
Vendor	pom	artifactid	plexus-build-api	Low
Vendor	jar	package name	plexus	Low
Vendor	jar	package name	build	Highest
Vendor	file	name	plexus-build-api	High
Vendor	pom	parent-artifactid	spice-parent	Low
Vendor	pom	groupid	sonatype.plexus	Highest
Vendor	jar	package name	build	Low
Vendor	pom	groupid	org.sonatype.plexus	Highest
Vendor	jar	package name	plexus	Highest
Vendor	jar	package name	sonatype	Low
Product	pom	groupid	sonatype.plexus	Highest
Product	jar	package name	sonatype	Highest
Product	pom	parent-groupid	org.sonatype.spice	Medium
Product	jar	package name	incremental	Low
Product	jar	package name	plexus	Low
Product	jar	package name	build	Highest
Product	file	name	plexus-build-api	High
Product	jar	package name	build	Low
Product	pom	artifactid	plexus-build-api	Highest
Product	pom	parent-artifactid	spice-parent	Medium
Product	jar	package name	plexus	Highest
Version	pom	version	0.0.7	Highest
Version	file	version	0.0.7	High
Version	pom	parent-version	0.0.7	Low

Identifiers

pkg:maven/org.sonatype.plexus/plexus-build-api@0.0.7 (Confidence:High)

plexus-utils-3.2.1.jar

Description:

A collection of various utility classes to ease working with strings, files, command lines, XML and
    more.

File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-utils/3.2.1/plexus-utils-3.2.1.jar
MD5: a1b7cb2baeae4bb4c3a016417d5d3cb0
SHA1: 13b015768e0d04849d2794e4c47eb02d01a0de32
SHA256:8d07b497bb8deb167ee5329cae87ef2043833bf52e4f15a5a9379cec447a5b2b
Referenced In Project/Scope:Lombok Maven Plugin:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	xml	Highest
Vendor	jar	package name	plexus	Low
Vendor	file	name	plexus-utils	High
Vendor	jar	package name	codehaus	Highest
Vendor	pom	parent-artifactid	plexus	Low
Vendor	pom	parent-groupid	org.codehaus.plexus	Medium
Vendor	jar	package name	util	Low
Vendor	pom	groupid	org.codehaus.plexus	Highest
Vendor	pom	groupid	codehaus.plexus	Highest
Vendor	pom	name	Plexus Common Utilities	High
Vendor	jar	package name	plexus	Highest
Vendor	pom	artifactid	plexus-utils	Low
Vendor	jar	package name	codehaus	Low
Product	jar	package name	util	Low
Product	jar	package name	xml	Highest
Product	jar	package name	plexus	Low
Product	file	name	plexus-utils	High
Product	pom	groupid	codehaus.plexus	Highest
Product	pom	name	Plexus Common Utilities	High
Product	jar	package name	codehaus	Highest
Product	pom	parent-artifactid	plexus	Medium
Product	pom	artifactid	plexus-utils	Highest
Product	jar	package name	plexus	Highest
Product	pom	parent-groupid	org.codehaus.plexus	Medium
Version	file	version	3.2.1	High
Version	pom	parent-version	3.2.1	Low
Version	pom	version	3.2.1	Highest

Identifiers

pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1 (Confidence:High)
cpe:2.3:a:plexus-utils_project:plexus-utils:3.2.1:*:*:*:*:*:*:* (Confidence:Highest)

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor

Project: Lombok Maven Plugin

org.projectlombok:lombok-maven-plugin:1.18.20.0

Summary

Dependencies

commons-lang3-3.8.1.jar

Evidence

Identifiers

lombok-1.18.20.jar

Evidence

Identifiers

plexus-build-api-0.0.7.jar

Evidence

Identifiers

plexus-utils-3.2.1.jar

Evidence

Identifiers

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: Lombok Maven Plugin

org.projectlombok:lombok-maven-plugin:1.18.20.0

Summary

Dependencies

commons-lang3-3.8.1.jar

Evidence

Identifiers

lombok-1.18.20.jar

Evidence

Identifiers

plexus-build-api-0.0.7.jar

Evidence

Identifiers

plexus-utils-3.2.1.jar

Evidence

Identifiers

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor