sbt-dependency-check-5.1.1-SNAPSHOT: 19 vulnerabilities (highest severity is: 8.8)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - sbt-dependency-check-5.1.1-SNAPSHOT</summary>


Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.google.guava/guava/bundles/guava-31.1-jre.jar



Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a></details>

## Vulnerabilities

| Vulnerability | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Dependency | Type | Fixed in (sbt-dependency-check version) | Remediation Possible** |
| ------------- | ------------- | ----- | ----- | ----- | ------------- | --- |
| [CVE-2025-48734](https://www.mend.io/vulnerability-database/CVE-2025-48734) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | commons-beanutils-1.9.4.jar | Transitive | N/A* | &#10060; |
| [CVE-2022-1471](https://www.mend.io/vulnerability-database/CVE-2022-1471) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.3 | snakeyaml-1.33.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | commons-compress-1.22.jar | Transitive | N/A* | &#10060; |
| [WS-2022-0468](https://github.com/FasterXML/jackson-core/issues/861) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-core-2.14.2.jar | Transitive | N/A* | &#10060; |
| [CVE-2025-52999](https://www.mend.io/vulnerability-database/CVE-2025-52999) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-core-2.14.2.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-34447](https://www.mend.io/vulnerability-database/CVE-2024-34447) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-30172](https://www.mend.io/vulnerability-database/CVE-2024-30172) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-29857](https://www.mend.io/vulnerability-database/CVE-2024-29857) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-30171](https://www.mend.io/vulnerability-database/CVE-2024-30171) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.9 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | commons-compress-1.22.jar | Transitive | N/A* | &#10060; |
| [CVE-2023-42503](https://www.mend.io/vulnerability-database/CVE-2023-42503) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | commons-compress-1.22.jar | Transitive | N/A* | &#10060; |
| [CVE-2023-33202](https://www.mend.io/vulnerability-database/CVE-2023-33202) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2023-2976](https://www.mend.io/vulnerability-database/CVE-2023-2976) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | guava-31.1-jre.jar | Transitive | N/A* | &#10060; |
| [CVE-2025-8916](https://www.mend.io/vulnerability-database/CVE-2025-8916) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2025-8885](https://www.mend.io/vulnerability-database/CVE-2025-8885) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | commons-lang3-3.12.0.jar | Transitive | N/A* | &#10060; |
| [CVE-2023-33201](https://www.mend.io/vulnerability-database/CVE-2023-33201) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | bcprov-jdk18on-1.71.jar | Transitive | N/A* | &#10060; |
| [CVE-2024-47554](https://www.mend.io/vulnerability-database/CVE-2024-47554) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.3 | commons-io-2.11.0.jar | Transitive | N/A* | &#10060; |
| [CVE-2020-8908](https://www.mend.io/vulnerability-database/CVE-2020-8908) | <img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> Low | 3.3 | guava-31.1-jre.jar | Transitive | N/A* | &#10060; |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2025-48734</summary>


### Vulnerable Library - commons-beanutils-1.9.4.jar

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/commons-beanutils/commons-beanutils/jars/commons-beanutils-1.9.4.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-beanutils-1.9.4.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Publish Date: 2025-05-28
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-48734>CVE-2025-48734</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-wxr5-93ph-8wr9">https://github.com/advisories/GHSA-wxr5-93ph-8wr9</a>
Release Date: 2025-05-28
Fix Resolution: commons-beanutils:commons-beanutils:1.11.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-1471</summary>


### Vulnerable Library - snakeyaml-1.33.jar

YAML 1.1 parser and emitter for Java
Library home page: <a href="https://bitbucket.org/snakeyaml/snakeyaml">https://bitbucket.org/snakeyaml/snakeyaml</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.yaml/snakeyaml/bundles/snakeyaml-1.33.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - jackson-dataformat-yaml-2.14.2.jar
 - :x: **snakeyaml-1.33.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Publish Date: 2022-12-01
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-1471>CVE-2022-1471</a>




### CVSS 3 Score Details (8.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374">https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374</a>
Release Date: 2022-12-01
Fix Resolution: org.yaml:snakeyaml:2.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2024-25710</summary>


### Vulnerable Library - commons-compress-1.22.jar

Apache Commons Compress software defines an API for working with
compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4,
Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.apache.commons/commons-compress/jars/commons-compress-1.22.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-compress-1.22.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.


 Mend Note: The description of this vulnerability differs from MITRE. 

Publish Date: 2024-02-19
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-25710>CVE-2024-25710</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.cve.org/CVERecord?id=CVE-2024-25710">https://www.cve.org/CVERecord?id=CVE-2024-25710</a>
Release Date: 2024-02-19
Fix Resolution: org.apache.commons:commons-compress:1.26.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2022-0468</summary>


### Vulnerable Library - jackson-core-2.14.2.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.14.2.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - jackson-module-afterburner-2.14.2.jar
 - :x: **jackson-core-2.14.2.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
The jackson-core package is vulnerable to a Denial of Service (DoS) attack. The methods in the classes listed below fail to restrict input size when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values. Deserializing many of the aforementioned objects may cause the application to exhaust all available resources, resulting in a DoS condition.

Publish Date: 2022-12-07
URL: <a href=https://github.com/FasterXML/jackson-core/issues/861>WS-2022-0468</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/FasterXML/jackson-core/issues/861">https://github.com/FasterXML/jackson-core/issues/861</a>
Release Date: 2022-12-07
Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.15.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2025-52999</summary>


### Vulnerable Library - jackson-core-2.14.2.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.14.2.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - jackson-module-afterburner-2.14.2.jar
 - :x: **jackson-core-2.14.2.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

Publish Date: 2025-06-25
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-52999>CVE-2025-52999</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3">https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3</a>
Release Date: 2025-06-25
Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.15.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2024-34447</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

Publish Date: 2024-05-03
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-34447>CVE-2024-34447</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.cve.org/CVERecord?id=CVE-2024-34447">https://www.cve.org/CVERecord?id=CVE-2024-34447</a>
Release Date: 2024-05-03
Fix Resolution: org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78, org.bouncycastle:bctls-fips:1.0.19





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2024-30172</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Publish Date: 2024-05-09
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-30172>CVE-2024-30172</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/bcgit/bc-java/issues/1599">https://github.com/bcgit/bc-java/issues/1599</a>
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2024-29857</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Publish Date: 2024-05-09
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-29857>CVE-2024-29857</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-8xfc-gm6g-vgpv">https://github.com/advisories/GHSA-8xfc-gm6g-vgpv</a>
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-30171</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Publish Date: 2024-05-09
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-30171>CVE-2024-30171</a>




### CVSS 3 Score Details (5.9)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-v435-xc8x-wvr9">https://github.com/advisories/GHSA-v435-xc8x-wvr9</a>
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-26308</summary>


### Vulnerable Library - commons-compress-1.22.jar

Apache Commons Compress software defines an API for working with
compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4,
Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.apache.commons/commons-compress/jars/commons-compress-1.22.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-compress-1.22.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
 Mend Note: The description of this vulnerability differs from MITRE. 

Publish Date: 2024-02-19
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-26308>CVE-2024-26308</a>




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.cve.org/CVERecord?id=CVE-2024-26308">https://www.cve.org/CVERecord?id=CVE-2024-26308</a>
Release Date: 2024-02-19
Fix Resolution: org.apache.commons:commons-compress:1.26.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2023-42503</summary>


### Vulnerable Library - commons-compress-1.22.jar

Apache Commons Compress software defines an API for working with
compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4,
Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.apache.commons/commons-compress/jars/commons-compress-1.22.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-compress-1.22.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0.

Users are recommended to upgrade to version 1.24.0, which fixes the issue.

A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.

In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.

Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].

[1]: https://issues.apache.org/jira/browse/COMPRESS-612 
[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 
[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html 
[4]: https://bugs.openjdk.org/browse/JDK-6560193 
[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 

Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.



Publish Date: 2023-09-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-42503>CVE-2023-42503</a>




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c">https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c</a>
Release Date: 2023-09-14
Fix Resolution: org.apache.commons:commons-compress:1.24.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2023-33202</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)

Publish Date: 2023-11-23
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-33202>CVE-2023-33202</a>




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-wjxj-5m7g-mg7q">https://github.com/advisories/GHSA-wjxj-5m7g-mg7q</a>
Release Date: 2023-11-23
Fix Resolution: org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2023-2976</summary>


### Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include
 utility classes, Google's collections, I/O classes, and
 much more.
Library home page: <a href="https://github.com/google/guava">https://github.com/google/guava</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.google.guava/guava/bundles/guava-31.1-jre.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **guava-31.1-jre.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Use of Java's default temporary directory for file creation in "FileBackedOutputStream" in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Publish Date: 2023-06-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-2976>CVE-2023-2976</a>




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-7g45-4rm6-3mm3">https://github.com/advisories/GHSA-7g45-4rm6-3mm3</a>
Release Date: 2023-06-14
Fix Resolution: com.google.guava:guava:32.0.1-android,32.0.1-jre





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2025-8916</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Publish Date: 2025-08-13
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-8916>CVE-2025-8916</a>




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/bcgit/bc-java/commit/ff444a479942d88de64004dc82c3ee32a9e9075a">https://github.com/bcgit/bc-java/commit/ff444a479942d88de64004dc82c3ee32a9e9075a</a>
Release Date: 2025-08-13
Fix Resolution: https://github.com/bcgit/bc-java.git - r1rv79





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2025-8885</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .
This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Publish Date: 2025-08-12
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-8885>CVE-2025-8885</a>




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865">https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865</a>
Release Date: 2025-08-12
Fix Resolution: https://github.com/bcgit/bc-java.git - r1rv78





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2025-48924</summary>


### Vulnerable Library - commons-lang3-3.12.0.jar

Apache Commons Lang, a package of Java utility classes for the
 classes that are in java.lang's hierarchy, or are considered to be so
 standard as to justify existence in java.lang.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.apache.commons/commons-lang3/jars/commons-lang3-3.12.0.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-lang3-3.12.0.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
 Mend Note: The description of this vulnerability differs from MITRE. 

Publish Date: 2025-07-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-48924>CVE-2025-48924</a>




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53">https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53</a>
Release Date: 2025-07-11
Fix Resolution: org.apache.commons:commons-lang3:3.18.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2023-33201</summary>


### Vulnerable Library - bcprov-jdk18on-1.71.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: <a href="https://www.bouncycastle.org/java.html">https://www.bouncycastle.org/java.html</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.bouncycastle/bcprov-jdk18on/jars/bcprov-jdk18on-1.71.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - packager-rpm-0.19.0.jar
 - packager-core-0.19.0.jar
 - :x: **bcprov-jdk18on-1.71.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Publish Date: 2023-07-05
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-33201>CVE-2023-33201</a>




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/bcgit/bc-java/wiki/CVE-2023-33201">https://github.com/bcgit/bc-java/wiki/CVE-2023-33201</a>
Release Date: 2023-07-05
Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-47554</summary>


### Vulnerable Library - commons-io-2.11.0.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
Library home page: <a href="https://www.apache.org/">https://www.apache.org/</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/commons-io/commons-io/jars/commons-io-2.11.0.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **commons-io-2.11.0.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
 Mend Note: The description of this vulnerability differs from MITRE. 

Publish Date: 2024-10-03
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-47554>CVE-2024-47554</a>




### CVSS 3 Score Details (4.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1">https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1</a>
Release Date: 2024-10-03
Fix Resolution: commons-io:commons-io:2.14.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> CVE-2020-8908</summary>


### Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include
 utility classes, Google's collections, I/O classes, and
 much more.
Library home page: <a href="https://github.com/google/guava">https://github.com/google/guava</a>
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.google.guava/guava/bundles/guava-31.1-jre.jar


Dependency Hierarchy:
 - sbt-dependency-check-5.1.1-SNAPSHOT (Root Library)
 - dependency-check-core-8.1.2.jar
 - :x: **guava-31.1-jre.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/GHE-self-hosted/sbt-dependency-check/commit/b08e3a79768910596a7d68223696b78924791969">b08e3a79768910596a7d68223696b78924791969</a>
Found in base branch: main




### Vulnerability Details
 
 
A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.
 Mend Note: The description of this vulnerability differs from MITRE. 

Publish Date: 2020-12-10
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-8908>CVE-2020-8908</a>




### CVSS 3 Score Details (3.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284">https://github.com/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284</a>
Release Date: 2020-12-10
Fix Resolution: https://github.com/google/guava.git - v32.0.0





</details>

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (sbt-dependency-check version)	Remediation Possible**
CVE-2025-48734	High	8.8	commons-beanutils-1.9.4.jar	Transitive	N/A*	❌
CVE-2022-1471	High	8.3	snakeyaml-1.33.jar	Transitive	N/A*	❌
CVE-2024-25710	High	8.1	commons-compress-1.22.jar	Transitive	N/A*	❌
WS-2022-0468	High	7.5	jackson-core-2.14.2.jar	Transitive	N/A*	❌
CVE-2025-52999	High	7.5	jackson-core-2.14.2.jar	Transitive	N/A*	❌
CVE-2024-34447	High	7.5	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2024-30172	High	7.5	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2024-29857	High	7.5	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2024-30171	Medium	5.9	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2024-26308	Medium	5.5	commons-compress-1.22.jar	Transitive	N/A*	❌
CVE-2023-42503	Medium	5.5	commons-compress-1.22.jar	Transitive	N/A*	❌
CVE-2023-33202	Medium	5.5	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2023-2976	Medium	5.5	guava-31.1-jre.jar	Transitive	N/A*	❌
CVE-2025-8916	Medium	5.3	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2025-8885	Medium	5.3	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2025-48924	Medium	5.3	commons-lang3-3.12.0.jar	Transitive	N/A*	❌
CVE-2023-33201	Medium	5.3	bcprov-jdk18on-1.71.jar	Transitive	N/A*	❌
CVE-2024-47554	Medium	4.3	commons-io-2.11.0.jar	Transitive	N/A*	❌
CVE-2020-8908	Low	3.3	guava-31.1-jre.jar	Transitive	N/A*	❌

Uh oh!

sbt-dependency-check-5.1.1-SNAPSHOT: 19 vulnerabilities (highest severity is: 8.8) #20

Description

Vulnerabilities

Details

Vulnerable Library - commons-beanutils-1.9.4.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - snakeyaml-1.33.jar

Vulnerability Details

CVSS 3 Score Details (8.3)

Suggested Fix

Vulnerable Library - commons-compress-1.22.jar

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - jackson-core-2.14.2.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-core-2.14.2.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (5.9)

Suggested Fix

Vulnerable Library - commons-compress-1.22.jar

Vulnerability Details

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - commons-compress-1.22.jar

Vulnerability Details

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - guava-31.1-jre.jar

Vulnerability Details

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - commons-lang3-3.12.0.jar

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - bcprov-jdk18on-1.71.jar

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - commons-io-2.11.0.jar

Vulnerability Details

CVSS 3 Score Details (4.3)

Suggested Fix

Vulnerable Library - guava-31.1-jre.jar

Vulnerability Details

CVSS 3 Score Details (3.3)