You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2024/09/22 06:06:46 UTC
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #207
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/207/display/redirect?page=changes>
Changes:
[github] Bump slf4j.version from 2.0.13 to 2.0.16
[github] Bump org.apache.commons:commons-compress from 1.26.2 to 1.27.1
[github] Bump actions/upload-artifact from 4.3.6 to 4.4.0
[github] Bump github/codeql-action from 3.26.2 to 3.26.6
[github] Bump spring.platformVersion from 5.3.37 to 5.3.39
[Lukasz Lenart] WW-5461 Extends UploadedFile with inputName field
[github] Bump maven-surefire-plugin.version from 3.4.0 to 3.5.0
[github] Bump org.assertj:assertj-core from 3.25.3 to 3.26.3
[github] Bump org.apache.maven.plugins:maven-dependency-plugin
[github] Bump org.jfree:jfreechart from 1.5.4 to 1.5.5
[github] Bump org.awaitility:awaitility from 4.2.1 to 4.2.2
------------------------------------------
[...truncated 947.46 KB...]
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/plexus/target/dependency-check-report.html>
[INFO]
[INFO] -----------< org.apache.struts:struts2-portlet-mocks-plugin >-----------
[INFO] Building DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 6.7.0-SNAPSHOT [24/39]
[INFO] from plugins/portlet-mocks/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce) @ struts2-portlet-mocks-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-maven-version) @ struts2-portlet-mocks-plugin ---
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-java-version) @ struts2-portlet-mocks-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-portlet-mocks-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-portlet-mocks-plugin ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/src/main/resources>
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-portlet-mocks-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 29 source files with javac [debug target 1.8] to target/classes
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-portlet-mocks-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-portlet-mocks-plugin ---
[INFO] Copying 1 resource from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-portlet-mocks-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug target 1.8] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.0:test (default-test) @ struts2-portlet-mocks-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.StrutsSpringPortletMockObjectsTest
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.667 s -- in org.apache.struts2.StrutsSpringPortletMockObjectsTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-portlet-mocks-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 33 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 33 licenses.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-portlet-mocks-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/struts2-portlet-mocks-plugin-6.7.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.12.1:attach-descriptor (attach-descriptor) @ struts2-portlet-mocks-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:10.0.3:check (default) @ struts2-portlet-mocks-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (365 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0:
spring-core-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-core@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*) : CVE-2023-20861
spring-expression-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*) : CVE-2023-20861, CVE-2023-20863, CVE-2024-38808
spring-web-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-web@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:web_project:web:4.3.30:release:*:*:*:*:*:*) : CVE-2024-38809, CVE-2024-22243, CVE-2024-22262, CVE-2023-20861
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.7.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 23.962 s]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 3.441 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:27 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.351 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.402 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 7.549 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.186 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 12.154 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 8.670 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 8.245 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.070 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 15.481 s]
[INFO] Struts 2 DWR Plugin ................................ SUCCESS [ 4.391 s]
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SUCCESS [ 12.354 s]
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SUCCESS [ 3.999 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.090 s]
[INFO] Struts 2 Java Templates Plugin ..................... SUCCESS [ 5.090 s]
[INFO] Struts 2 JFreeChart Plugin ......................... SUCCESS [ 6.284 s]
[INFO] Struts 2 JSON Plugin ............................... SUCCESS [ 10.191 s]
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SUCCESS [ 6.214 s]
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SUCCESS [ 7.842 s]
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SUCCESS [ 3.033 s]
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SUCCESS [ 3.967 s]
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 FAILURE [ 5.582 s]
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:26 min
[INFO] Finished at: 2024-09-22T06:06:44Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.3:check (default) on project struts2-portlet-mocks-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-web-4.3.30.RELEASE.jar: CVE-2024-22262(8.100000381469727), CVE-2024-38809(8.699999809265137), CVE-2024-22243(8.100000381469727)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-portlet-mocks-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #212
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/212/display/redirect?page=changes>
Changes:
[Lukasz Lenart] WW-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141
[Lukasz Lenart] IPAGE-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141 remove code for "pell multipart plugin"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WW-5141 TODO: TEMPORARY comment-out incomaptible commons-upload old version code
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] IPAGE-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141 fix security test
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141 temp IGNORE test require commons-upload upgrade
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141 conversion to fileupload2
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5141 fix formatting problems
[Lukasz Lenart] WW-5335 Prepares for Java 17 & Struts 7.x
[Lukasz Lenart] WW-5335 Reverts adding release/struts-7-0-x branch to scorecards analysis
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5335 Prepares for Java 17 & Struts 7.x
[Lukasz Lenart] WW-5335 Reverts adding release/struts-7-0-x branch to scorecards analysis
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] Revert "WN-5141"
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WN-5141
[Lukasz Lenart] [WW-5141] Removes deprecated plugins (#798)
[Lukasz Lenart] WW-5335 Prepares for Java 17 & Struts 7.x
[Lukasz Lenart] WW-5335 Reverts adding release/struts-7-0-x branch to scorecards analysis
[Lukasz Lenart] [WW-5141] Removes deprecated plugins (#798)
[Lukasz Lenart] Delete unused files missed in previous PR
[Lukasz Lenart] Delete remaining deprecated plugins
[Lukasz Lenart] WN-5141 fix whitespace issues
[Lukasz Lenart] Upgrades Htmlunit to version 3.6.0
[Lukasz Lenart] WN-5141
[Lukasz Lenart] WW-5371 Implements action based file upload
[Lukasz Lenart] WW-5371 Document how to use the new file upload logic
[Lukasz Lenart] WW-5370 Simplifies error handling logic
[Lukasz Lenart] WW-5371 Migrates modern upload change to JakartaEE
[Lukasz Lenart] WW-5371 Migrates modern upload change to JakartaEE
[Lukasz Lenart] WW-5364 fixes automatically populated OGNL allowlist
[Lukasz Lenart] WW-5339 Add option to block custom OGNL maps
[Lukasz Lenart] Adds missing import
[Lukasz Lenart] Replaces empty file upload test with simple one
[Lukasz Lenart] Upgrades Maven wrapper
[Lukasz Lenart] Fixes pipeline to properly handle transformed artifacts
[Lukasz Lenart] Moves JakartaEE related modules into dedicate subdirectory
[Lukasz Lenart] Fixes typo in pom
[Lukasz Lenart] Upgrades Mockito to ver 5.8.0
[git] Dependency manage byte-buddy
[git] Alphabetise dependency version props
[git] Upgrade Maven Surefire version
[Lukasz Lenart] Fixes wrong version in BOM
[Lukasz Lenart] Configure assembly plugin to use proper folders
[Lukasz Lenart] Cleans up assembly definitions
[Lukasz Lenart] Configures source-release assembly
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M1
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Sebastian.Peters] Upgrade maven to 3.9.6 and wrapper to 3.2.0
[Lukasz Lenart] WW-5388 Uses the latest JakartaEE FileUpload Servlet 6 package
[Lukasz Lenart] WW-5388 Updates tests to match new logic
[Lukasz Lenart] WW-5388 Simplifies code
[Lukasz Lenart] WW-5388 Avoids unconditional invocations of method in logs
[Lukasz Lenart] WW-5388 Adds tests per each Jakarta parser
[Lukasz Lenart] WW-5388 Drops unused defaultLocale
[Lukasz Lenart] WW-5388 Uses temp directory to avoid problems on Jenkins
[Lukasz Lenart] WW-5388 Test multi-files and fields
[Lukasz Lenart] WW-5388 Introduces new constant to allow control max number of files
[Lukasz Lenart] WW-5388 Extracts method to read charset
[Lukasz Lenart] WW-5388 Adds dedicated integration test to cover max size upload
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M2
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Lukasz Lenart] WW-5390 Fixes generating assemblies during release process
[Lukasz Lenart] Ensures if temp folder is writable
[Sebastian.Peters] Update log4j2 to 2.21.1
[Sebastian.Peters] [WW-5384] Update log4j2 to 2.22.1
[Sebastian.Peters] [WW-5393] Update caffeine to 3.1.8
[Sebastian.Peters] Override version of error_prone_annotations
[Lukasz Lenart] WW-5388 Fixes a few issues in Servlet 6 file upload usage
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M3
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Greg Huber] Fix file upload to use actual file name rather than uploadxxx.tmp
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M4
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Lukasz Lenart] Fixes after merge assembly issue
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M5
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Lukasz Lenart] Fixes creating assembly during release process
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M6
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[git] WW-5353 Stronger security defaults for 7.0
[git] WW-5353 Test fixes
[Lukasz Lenart] WW-5423 Fixes returning null instead of empty array in case of non-existing param
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M7
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Lukasz Lenart] WW-5430 Uses Freemarker native support for JakartaEE instead of manually transforming the artifacts
[git] WW-5411 Delete deprecated methods from OgnlValueStack
[git] WW-5411 Delete deprecated methods from cache factories and OgnlUtil constructor
[git] WW-5411 Delete deprecated methods from OgnlUtil
[git] WW-5411 Delete deprecated members from prepare filters
[git] WW-5411 Delete misc deprecated methods from 6.2.0
[git] WW-5411 Delete deprecated Velocity injection methods
[git] WW-5411 Delete misc deprecated methods from 6.4.0
[git] WW-5411 Delete deprecated Aware marker interfaces
[git] WW-5411 Delete more deprecated methods from OgnlUtil
[Lukasz Lenart] WW-5438 Fixes scope of Weld dependencies
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M8
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M9
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[git] WW-5411 Delete deprecated code part 1
[git] WW-5411 Delete deprecated code part 2
[git] WW-5411 Delete deprecated code part 3
[git] WW-5411 Delete deprecated code part 4
[git] WW-5411 Delete deprecated code part 5
[git] WW-5411 Misc code cleanup
[git] WW-5411 General code clean up using modern language features
[git] WW-5411 Delete deprecated code part 6
[git] WW-5411 Delete old comment
[git] WW-5411 Delete unsupported static field templating
[git] WW-5386 Delete deprecated FileUploadInterceptor
[git] WW-5449 Make Velocity Tools dependency optional for Velocity plugin
[git] WW-5449 Minor clean up
[git] WW-5449 Include Velocity Tools dependencies explicitly in Showcase app
[git] WW-5449 Increase coverage
[git] WW-5453 Rename VelocityManager interface and default implementation
[git] WW-5454 Log warnings on startup for disabled critical security features
[Lukasz Lenart] WW-5450 Uses existing Jakarta constants instead of free hand strings
[Lukasz Lenart] WW-5450 Avoids accessing parameters via a key
[Lukasz Lenart] WW-5450 Uses proper naming when defining a constant
[Lukasz Lenart] WW-5450 Simplifies boolean expression
[Lukasz Lenart] WW-5450 Drops unused import
[Lukasz Lenart] WW-5461 Extends UploadedFile with inputName field
[Lukasz Lenart] WW-5458 Replaces e.printStackTrace() with proper logger
[Lukasz Lenart] WW-5468 Fixes @StrutsParameter for ModelDriven
[git] WW-5468 Reworked fix, exempt ModelDriven Action parameters
[Lukasz Lenart] WW-5465 Renames tag parameters to attributes
[Lukasz Lenart] WW-5465 Short-circuits attributes processing if not found in ValueStack
[git] WW-5468 Remove unneeded annotations
[git] WW-5468 Replace tabs with spaces
[Lukasz Lenart] WW-5473 Fixes examining multiple HttpServletWrappers to find MultiPartRequestWrapper
[Lukasz Lenart] WW-5472 Removes Struts Sitemesh plugin
[Lukasz Lenart] WW-5209 Upgrade to Jakarta Bean Validation 3.1.0
[Lukasz Lenart] WW-5427 Upgrades Freemarker incompatible_improvements to version 2.3.33
[git] Fix merge errors
[git] WW-3714 Moves all classes from com.opensymphony.xwork2 into org.apache.struts2
[git] Replace com.opensymphony.xwork2 mentions
[git] WW-5478 Delete deprecated DefaultResultFactory
[git] WW-3714 Move new Result class into result package
[Lukasz Lenart] WW-5459 Moves Action interface into org.apache.struts2.action package
[Lukasz Lenart] WW-5459 Moves ActionChainResult into org.apache.struts2.result package
[Lukasz Lenart] Uses proper default package name
[Lukasz Lenart] WW-5459 Updates content of zipped XMLs
[Lukasz Lenart] Creates temp folder in target folder
[Lukasz Lenart] WW-5481 Moves text related classes into org.apache.struts2.text
[Lukasz Lenart] WW-5481 Extracts duplicated code
[Lukasz Lenart] WW-5482 Moves locale related code into org.apache.struts2.locale
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_0_0_M10
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[github] Bump org.apache.maven.plugins:maven-project-info-reports-plugin
[Lukasz Lenart] WW-5486 Fixes exposing params added by ServletDispatcherResult
[Lukasz Lenart] WW-5486 Simplifies test to avoid using mocks
[Lukasz Lenart] WW-5486 Removes try-catches
[Lukasz Lenart] WW-5463 Exposes final location as request attribute FORWARD_SERVLET_PATH
[github] Bump maven-surefire-plugin.version from 3.5.1 to 3.5.2
[github] Bump jackson.version from 2.18.0 to 2.18.2
[github] Bump github/codeql-action from 3.27.4 to 3.27.5
------------------------------------------
[...truncated 43.62 KiB...]
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-view-jakarta/target/dependency-check-report.html>
[INFO]
[INFO] --------< org.apache.struts:struts2-velocity-tools-jsp-jakarta >--------
[INFO] Building Struts 2 Jakarta EE Compatible Velocity Tools Jsp 7.0.0-M11-SNAPSHOT [5/27]
[INFO] from jakarta/velocity-tools-jsp-jakarta/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-maven-version) @ struts2-velocity-tools-jsp-jakarta ---
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-java-version) @ struts2-velocity-tools-jsp-jakarta ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-jsp-jakarta/src/main/resources>
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] No sources to compile
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-jsp-jakarta/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-jsp-jakarta/src/test/resources>
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.5.2:test (default-test) @ struts2-velocity-tools-jsp-jakarta ---
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 1 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 1 licenses.
[INFO]
[INFO] --- site:3.20.0:attach-descriptor (attach-descriptor) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- transformer:0.5.0:jar (eclipse-transformer-velocity-tools-jsp-jar) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Properties [ RULES_SELECTIONS ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-selection.properties ]
[INFO] Properties [ RULES_RENAMES ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ RULES_VERSIONS ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-versions.properties ]
[INFO] Properties [ RULES_BUNDLES ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-bundles.properties ]
[INFO] Properties [ RULES_DIRECT ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ RULES_MASTER_TEXT ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-text-master.properties ]
[INFO] Package renames are in use
[INFO] Package versions will be updated
[INFO] Bundle identities will be updated
[INFO] Properties [ Substitutions matching [ application-client.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-application-xml.properties ]
[INFO] Properties [ Substitutions matching [ application-client.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ application-client.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ persistence.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-persistence-xml.properties ]
[INFO] Properties [ Substitutions matching [ persistence.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ persistence.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ web.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-web-xml.properties ]
[INFO] Properties [ Substitutions matching [ web.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ web.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ beans.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-beans-xml.properties ]
[INFO] Properties [ Substitutions matching [ beans.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ beans.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ *.faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-faces-config-xml.properties ]
[INFO] Properties [ Substitutions matching [ *.faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ *.faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ *.taglib.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ *.tld ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ *.tld ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ application.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-application-xml.properties ]
[INFO] Properties [ Substitutions matching [ application.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ application.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ ra.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-ra-xml.properties ]
[INFO] Properties [ Substitutions matching [ ra.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ ra.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ *.tag ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ *.tag ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-faces-config-xml.properties ]
[INFO] Properties [ Substitutions matching [ faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ faces-config.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ ejb-jar.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-ejb-jar-xml.properties ]
[INFO] Properties [ Substitutions matching [ ejb-jar.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ ejb-jar.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ web-fragment.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-web-xml.properties ]
[INFO] Properties [ Substitutions matching [ web-fragment.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ web-fragment.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Properties [ Substitutions matching [ permissions.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-permissions-xml.properties ]
[INFO] Properties [ Substitutions matching [ permissions.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-direct.properties ]
[INFO] Properties [ Substitutions matching [ permissions.xml ] ] URL [ jar:file:/home/jenkins/.m2/repository/org/eclipse/transformer/org.eclipse.transformer.jakarta/0.5.0/org.eclipse.transformer.jakarta-0.5.0.jar!/org/eclipse/transformer/jakarta/jakarta-renames.properties ]
[INFO] Text files will be updated
[INFO] Java direct string updates will be performed
[INFO] All resources will be selected
[INFO] Input [ /home/jenkins/.m2/repository/org/apache/velocity/tools/velocity-tools-view-jsp/3.1/velocity-tools-view-jsp-3.1.jar ]
[INFO] Output [ <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-jsp-jakarta/target/struts2-velocity-tools-jsp-jakarta-7.0.0-M11-SNAPSHOT.jar> ]
[INFO] [ All Resources ] [ 16 ] Unaccepted [ 0 ] Accepted [ 16 ]
[INFO] [ All Unchanged ] [ 8 ] Failed [ 0 ] Duplicated [ 0 ]
[INFO] [ All Changed ] [ 8 ] Renamed [ 0 ] Content [ 8 ]
[INFO]
[INFO] --- dependency-check:10.0.4:check (default) @ struts2-velocity-tools-jsp-jakarta ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (413 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (3 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/jakarta/velocity-tools-jsp-jakarta/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jakarta EE Compatible Velocity Tools Jsp:
velocity-engine-core-2.3.jar/META-INF/maven/commons-io/commons-io/pom.xml (pkg:maven/commons-io/commons-io@2.8.0, cpe:2.3:a:apache:commons_io:2.8.0:*:*:*:*:*:*:*) : CVE-2024-47554
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.0.0-M11-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [57:02 min]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 3.950 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.654 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 12.875 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. FAILURE [ 7.766 s]
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 57:33 min
[INFO] Finished at: 2024-12-01T06:58:50Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.4:check (default) on project struts2-velocity-tools-jsp-jakarta:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] velocity-engine-core-2.3.jar/META-INF/maven/commons-io/commons-io/pom.xml: CVE-2024-47554(8.699999809265137)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-velocity-tools-jsp-jakarta
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #211
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/211/display/redirect?page=changes>
Changes:
[git] Merge pull request #1072 from apache/fix/WW-5468-modeldriven-2
[git] WW-5478 Deprecate DefaultResultFactory
[git] WW-5478 Fix ActionContext equals/hashCode contract
[git] WW-5480 Warn against potential templating bug
[git] WW-3714 Move new Result class into result package
[git] WW-5459 Move new Action class into action package
[git] WW-5459 Deprecate and repackage ActionChainResult
[git] WW-3714 Ensure correct delegation of new Result API
[git] WW-3714 Ensure correct delegation of new Interceptor API
[github] Bump github/codeql-action from 3.27.0 to 3.27.1
[Lukasz Lenart] WW-5484 Marks the DWR plugin as deprecated
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_6_7_0
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[github] Bump github/codeql-action from 3.27.1 to 3.27.4
[Sebastian.Peters] Add .gitattributes in case people don't have core.autocrlf set
[Sebastian.Peters] Upgrade maven to 3.9.9 and wrapper to 3.3.2
[Lukasz Lenart] Always run Sonar scan against the master branch
[Lukasz Lenart] Runs Sonar step in case of running on master or PR
[Lukasz Lenart] Uses Java 21 when running Sonar check
[Lukasz Lenart] Avoids running Sonar scan in forks
[github] Skip Sonar scan on PRs created by Dependabot
[Lukasz Lenart] Uses AND instead of OR to check Sonar prerequisites
------------------------------------------
[...truncated 6.41 KB...]
[INFO] --- apache-rat:0.15:check (default) @ struts2-parent ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Parsing exclusions from <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/.gitignore>
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 89 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 3 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 3 licenses.
[INFO]
[INFO] --- site:3.20.0:attach-descriptor (attach-descriptor) @ struts2-parent ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[INFO]
[INFO] --- dependency-check:10.0.4:check (default) @ struts2-parent ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 10 time
[INFO] NVD API has 246,769 records in this update
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=6000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[INFO] Downloaded 10,000/246,779 (4%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=18000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[INFO] Downloaded 20,000/246,779 (8%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=22000 : 2 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=24000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[INFO] Downloaded 30,000/246,779 (12%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 10 time
[INFO] Downloaded 40,000/246,780 (16%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=44000 : 2 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=46000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[INFO] Downloaded 50,000/246,780 (20%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=50000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=58000 : 2 time
[INFO] Downloaded 60,000/246,780 (24%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=60000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=62000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=64000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 10 time
[WARNING] NVD API request failures are occurring; retrying request for the 11 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 10 time
[INFO] Downloaded 70,000/246,780 (28%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=72000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2024-11-13T14%3A00%3A03Z&lastModEndDate=2025-03-13T14%3A00%3A03Z&resultsPerPage=2000&startIndex=76000 : 2 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[WARNING] NVD API request failures are occurring; retrying request for the 8 time
[WARNING] NVD API request failures are occurring; retrying request for the 9 time
[WARNING] NVD API request failures are occurring; retrying request for the 10 time
[WARNING] NVD API request failures are occurring; retrying request for the 11 time
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:395)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1967)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1150)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:903)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:280)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:203)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:412)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:352)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1967)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1150)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:903)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:280)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:203)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (10191 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.7.1-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [ 03:22 h]
[INFO] Struts 2 Bill of Materials ......................... SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] DEPRECATED: Struts 2 DWR Plugin - since 6.7.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 Sitemesh Plugin ............... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 03:22 h
[INFO] Finished at: 2024-11-22T09:23:38Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.4:check (default) on project struts2-parent: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: NVD Returned Status Code: 503
[ERROR] NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #210
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/210/display/redirect?page=changes>
Changes:
[git] WW-3714 Deprecate and migrate ActionInvocation
[git] WW-3714 Deprecate and migrate PreResultListener
[git] WW-3714 Update new ActionContext with new ActionInvocation
[git] WW-3714 Add factory support for new Interceptor, Result interfaces
[github] Bump github/codeql-action from 3.26.12 to 3.26.13
[github] Bump maven-surefire-plugin.version from 3.5.0 to 3.5.1
[github] Bump org.apache.maven.doxia:doxia-core from 1.12.0 to 2.0.0
[github] Bump org.apache.commons:commons-lang3 from 3.15.0 to 3.17.0
[github] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.3.1 to 3.5.1
[git] WW-3714 Ensure ReflectionExceptionHandler, WithLazyParams, ParamNameAwareResult marker interfaces respected
[git] WW-3714 Deprecate and migrate ActionEventListener
[git] WW-3714 Deprecate and migrate ActionProxy
[git] WW-3714 Deprecate and migrate ValueStack
[git] WW-3714 Deprecate and migrate assorted marker interfaces
[git] WW-3714 Update new ActionContext with new ValueStack
[git] WW-3714 Shortcut adapters
[git] WW-3714 Marker interface migration follow-up
[git] WW-3714 Fix replacement ValidationAware marker not recognised
[git] WW-3714 Deprecate and migrate ActionSupport
[git] WW-3714 Deprecate and migrate AbstractInterceptor and MethodFilterInterceptor
[git] WW-3714 Add alternative constructors in InterceptorMapping
[git] WW-3714 Replace deprecated APIs in new ActionSupport
[git] WW-3714 Deprecate and migrate assorted Interceptors
[git] WW-3714 Update StrutsResultSupport to allow overriding new signature
[Lukasz Lenart] WW-5476 Deprecates tag's parameters as replaced with attributes
[github] Bump asm.version from 9.7 to 9.7.1
[github] Bump github/codeql-action from 3.26.13 to 3.27.0
------------------------------------------
[...truncated 759.50 KB...]
[INFO]
[INFO] -------------< org.apache.struts:struts2-velocity-plugin >--------------
[INFO] Building Struts 2 Velocity Plugin 6.7.0-SNAPSHOT [10/39]
[INFO] from plugins/velocity/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[WARNING] Parameter 'relativizeDecorationLinks' is unknown for plugin 'maven-site-plugin:3.20.0:attach-descriptor (attach-descriptor)'
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce) @ struts2-velocity-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-maven-version) @ struts2-velocity-plugin ---
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-java-version) @ struts2-velocity-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-velocity-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-velocity-plugin ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-velocity-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 48 source files with javac [debug target 1.8] to target/classes
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/main/java/org/apache/struts2/views/velocity/components/DateDirective.java>: Some input files use or override a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/main/java/org/apache/struts2/views/velocity/components/DateDirective.java>: Recompile with -Xlint:deprecation for details.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/main/java/org/apache/struts2/views/velocity/components/AbstractDirective.java>: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/main/java/org/apache/struts2/views/velocity/components/AbstractDirective.java> uses unchecked or unsafe operations.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/main/java/org/apache/struts2/views/velocity/components/AbstractDirective.java>: Recompile with -Xlint:unchecked for details.
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-velocity-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-velocity-plugin ---
[INFO] Copying 1 resource from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-velocity-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 4 source files with javac [debug target 1.8] to target/test-classes
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/test/java/org/apache/struts2/views/velocity/VelocityManagerTest.java>: Some input files use or override a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/src/test/java/org/apache/struts2/views/velocity/VelocityManagerTest.java>: Recompile with -Xlint:deprecation for details.
[INFO]
[INFO] --- surefire:3.5.1:test (default-test) @ struts2-velocity-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.velocity.result.VelocityResultTest
SLF4J(W): No SLF4J providers were found.
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
[MockitoHint] VelocityResultTest.testResourcesFoundUsingNames (see javadoc for MockitoHint):
[MockitoHint] 1. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:64)
[MockitoHint] VelocityResultTest.testResourcesFoundUsingAbsolutePath (see javadoc for MockitoHint):
[MockitoHint] 1. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:62)
[MockitoHint] 2. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:63)
[MockitoHint] 3. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:64)
[MockitoHint] VelocityResultTest.testCanResolveLocationUsingOgnl (see javadoc for MockitoHint):
[MockitoHint] 1. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:62)
[MockitoHint] 2. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:63)
[MockitoHint] VelocityResultTest.testCanResolveLocationUsingStaticExpression (see javadoc for MockitoHint):
[MockitoHint] 1. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:62)
[MockitoHint] 2. Unused -> at org.apache.struts2.views.velocity.result.VelocityResultTest.init(VelocityResultTest.java:63)
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.351 s -- in org.apache.struts2.views.velocity.result.VelocityResultTest
[INFO] Running org.apache.struts2.views.velocity.StrutsVelocityContextTest
[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.183 s -- in org.apache.struts2.views.velocity.StrutsVelocityContextTest
[INFO] Running org.apache.struts2.views.velocity.VelocityManagerTest
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.404 s -- in org.apache.struts2.views.velocity.VelocityManagerTest
[INFO] Running org.apache.struts2.views.velocity.template.VelocityTemplateEngineTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.033 s -- in org.apache.struts2.views.velocity.template.VelocityTemplateEngineTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 18, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-velocity-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 57 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 57 licenses.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-velocity-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/target/struts2-velocity-plugin-6.7.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.20.0:attach-descriptor (attach-descriptor) @ struts2-velocity-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:10.0.4:check (default) @ struts2-velocity-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (382 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/velocity/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Velocity Plugin:
velocity-engine-core-2.3.jar/META-INF/maven/commons-io/commons-io/pom.xml (pkg:maven/commons-io/commons-io@2.8.0, cpe:2.3:a:apache:commons_io:2.8.0:*:*:*:*:*:*:*) : CVE-2024-47554
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.7.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 35.621 s]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 3.383 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:32 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 2.951 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.293 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 7.736 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.657 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.834 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 8.869 s]
[INFO] Struts 2 Velocity Plugin ........................... FAILURE [ 8.315 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 DWR Plugin ................................ SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 Sitemesh Plugin ............... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 04:03 min
[INFO] Finished at: 2024-11-01T06:05:23Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.4:check (default) on project struts2-velocity-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] velocity-engine-core-2.3.jar/META-INF/maven/commons-io/commons-io/pom.xml: CVE-2024-47554(8.699999809265137)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-velocity-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #209
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/209/display/redirect?page=changes>
Changes:
[github] Bump commons-logging:commons-logging from 1.3.3 to 1.3.4
[github] Bump log4j2.version from 2.23.1 to 2.24.1
[github] Bump org.apache.maven.plugins:maven-project-info-reports-plugin
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_6_6_1
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[43964333+JCgH4164838Gh792C124B5] Initial Commit:
[github] Bump github/codeql-action from 3.26.8 to 3.26.12
[github] Bump actions/upload-artifact from 4.4.0 to 4.4.3
[github] Bump jackson.version from 2.17.2 to 2.18.0
[Lukasz Lenart] WW-5471 Marks Sitemesh plugin as deprecated
[git] WW-3714 Deprecate and migrate Action, Interceptor, Result
[git] WW-3714 Deprecate and migrate ActionContext
[git] WW-3714 Deprecate and migrate ConditionalInterceptor
------------------------------------------
[...truncated 9.95 KB...]
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Failed to parse NVD data
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:363)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:352)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1967)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1150)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:903)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:280)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:203)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: com.fasterxml.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ExploitMaturityType`, problem: PROOF-OF-CONCEPT
at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 8597884] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20["vulnerabilities"]->java.util.ArrayList[1568]->io.github.jeremylong.openvulnerability.client.nvd.DefCveItem["cve"]->io.github.jeremylong.openvulnerability.client.nvd.CveItem["metrics"]->io.github.jeremylong.openvulnerability.client.nvd.Metrics["cvssMetricV40"]->java.util.ArrayList[0]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4["cvssData"]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data["exploitMaturity"])
at com.fasterxml.jackson.databind.exc.ValueInstantiationException.from (ValueInstantiationException.java:47)
at com.fasterxml.jackson.databind.DeserializationContext.instantiationException (DeserializationContext.java:2014)
at com.fasterxml.jackson.databind.DeserializationContext.handleInstantiationProblem (DeserializationContext.java:1426)
at com.fasterxml.jackson.databind.deser.std.FactoryBasedEnumDeserializer.deserialize (FactoryBasedEnumDeserializer.java:205)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray (CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray (CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue (DefaultDeserializationContext.java:342)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose (ObjectMapper.java:4905)
at com.fasterxml.jackson.databind.ObjectMapper.readValue (ObjectMapper.java:3848)
at com.fasterxml.jackson.databind.ObjectMapper.readValue (ObjectMapper.java:3816)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:358)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:352)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1967)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1150)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:903)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:280)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:203)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: java.lang.IllegalArgumentException: PROOF-OF-CONCEPT
at io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ExploitMaturityType.fromValue (CvssV4Data.java:974)
at sun.reflect.GeneratedMethodAccessor45.invoke (Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at com.fasterxml.jackson.databind.introspect.AnnotatedMethod.callOnWith (AnnotatedMethod.java:118)
at com.fasterxml.jackson.databind.deser.std.FactoryBasedEnumDeserializer.deserialize (FactoryBasedEnumDeserializer.java:194)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray (CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray (CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize (CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet (FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize (BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize (BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue (DefaultDeserializationContext.java:342)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose (ObjectMapper.java:4905)
at com.fasterxml.jackson.databind.ObjectMapper.readValue (ObjectMapper.java:3848)
at com.fasterxml.jackson.databind.ObjectMapper.readValue (ObjectMapper.java:3816)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:358)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:352)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1967)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1150)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:903)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:280)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:203)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.7.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [ 53.998 s]
[INFO] Struts 2 Bill of Materials ......................... SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 DWR Plugin ................................ SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 Sitemesh Plugin ............... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 56.411 s
[INFO] Finished at: 2024-10-22T06:02:13Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.4:check (default) on project struts2-parent: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: Failed to parse NVD data
[ERROR] caused by ValueInstantiationException: Cannot construct instance of `io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ExploitMaturityType`, problem: PROOF-OF-CONCEPT
[ERROR] at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 8597884] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20["vulnerabilities"]->java.util.ArrayList[1568]->io.github.jeremylong.openvulnerability.client.nvd.DefCveItem["cve"]->io.github.jeremylong.openvulnerability.client.nvd.CveItem["metrics"]->io.github.jeremylong.openvulnerability.client.nvd.Metrics["cvssMetricV40"]->java.util.ArrayList[0]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4["cvssData"]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data["exploitMaturity"])
[ERROR] caused by IllegalArgumentException: PROOF-OF-CONCEPT
[ERROR] NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-JDK8-dependency-check #208
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/208/display/redirect?page=changes>
Changes:
[github] Bump org.apache.maven.plugins:maven-site-plugin from 3.12.1 to 3.20.0
[github] Bump org.owasp:dependency-check-maven from 10.0.3 to 10.0.4
[github] Bump org.codehaus.mojo:exec-maven-plugin from 3.3.0 to 3.4.1
[github] Bump github/codeql-action from 3.26.6 to 3.26.8
[Lukasz Lenart] WW-5297 Fixes checking nonce of invalidated session
------------------------------------------
[...truncated 950.40 KB...]
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/plexus/target/dependency-check-report.html>
[INFO]
[INFO] -----------< org.apache.struts:struts2-portlet-mocks-plugin >-----------
[INFO] Building DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 6.7.0-SNAPSHOT [24/39]
[INFO] from plugins/portlet-mocks/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[WARNING] Parameter 'relativizeDecorationLinks' is unknown for plugin 'maven-site-plugin:3.20.0:attach-descriptor (attach-descriptor)'
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce) @ struts2-portlet-mocks-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-maven-version) @ struts2-portlet-mocks-plugin ---
[INFO]
[INFO] --- enforcer:3.5.0:enforce (enforce-java-version) @ struts2-portlet-mocks-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-portlet-mocks-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-portlet-mocks-plugin ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/src/main/resources>
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-portlet-mocks-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 29 source files with javac [debug target 1.8] to target/classes
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-portlet-mocks-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-portlet-mocks-plugin ---
[INFO] Copying 1 resource from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-portlet-mocks-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug target 1.8] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.0:test (default-test) @ struts2-portlet-mocks-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.StrutsSpringPortletMockObjectsTest
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.823 s -- in org.apache.struts2.StrutsSpringPortletMockObjectsTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-portlet-mocks-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 33 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 33 licenses.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-portlet-mocks-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/struts2-portlet-mocks-plugin-6.7.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.20.0:attach-descriptor (attach-descriptor) @ struts2-portlet-mocks-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:10.0.4:check (default) @ struts2-portlet-mocks-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (406 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-mocks/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0:
spring-core-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-core@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*) : CVE-2023-20861
spring-expression-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*) : CVE-2023-20861, CVE-2023-20863, CVE-2024-38808
spring-web-4.3.30.RELEASE.jar (pkg:maven/org.springframework/spring-web@4.3.30.RELEASE, cpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*, cpe:2.3:a:web_project:web:4.3.30:release:*:*:*:*:*:*) : CVE-2024-22243, CVE-2024-22262, CVE-2023-20861, CVE-2024-38809
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.7.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 29.954 s]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 4.086 s]
[INFO] Struts 2 Core ...................................... SUCCESS [03:35 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.528 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.798 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 9.013 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 7.192 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 15.123 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 12.215 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.705 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.770 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 19.529 s]
[INFO] Struts 2 DWR Plugin ................................ SUCCESS [ 5.037 s]
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SUCCESS [ 15.403 s]
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SUCCESS [ 4.791 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.685 s]
[INFO] Struts 2 Java Templates Plugin ..................... SUCCESS [ 6.914 s]
[INFO] Struts 2 JFreeChart Plugin ......................... SUCCESS [ 8.757 s]
[INFO] Struts 2 JSON Plugin ............................... SUCCESS [ 14.335 s]
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SUCCESS [ 8.009 s]
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SUCCESS [ 10.181 s]
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SUCCESS [ 4.040 s]
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SUCCESS [ 4.210 s]
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 FAILURE [ 7.385 s]
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 07:20 min
[INFO] Finished at: 2024-10-01T06:08:43Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.4:check (default) on project struts2-portlet-mocks-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-web-4.3.30.RELEASE.jar: CVE-2024-22262(8.100000381469727), CVE-2024-22243(8.100000381469727)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-portlet-mocks-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3