You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2026/03/29 21:59:55 UTC
Build failed in Jenkins: Struts » Struts-examples-dependency-check #167
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/167/display/redirect>
Changes:
------------------------------------------
[...truncated 83 B...]
The recommended git tool is: NONE
No credentials specified
Cloning the remote Git repository
Cloning repository https://gitbox.apache.org/repos/asf/struts-examples.git
> git init <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/> # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
Avoid second fetch
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Commit message: "Merge pull request #507 from apache/dependabot/github_actions/actions/checkout-6.0.0"
> git rev-list --no-walk 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins11805013428506321422.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
Downloading from apache-public: https://repository.apache.org/content/groups/public/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from central: https://repo.maven.apache.org/maven2/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Progress (1): 789 BProgress (1): 2.0 kBProgress (1): 7.9 kBProgress (1): 15 kB Progress (1): 20 kBProgress (1): 32 kBProgress (1): 40 kBProgress (1): 47 kBProgress (1): 57 kBProgress (1): 67 kBProgress (1): 74 kBProgress (1): 87 kBProgress (1): 98 kBProgress (1): 105 kBProgress (1): 115 kBProgress (1): 126 kBProgress (1): 133 kBProgress (1): 146 kBProgress (1): 153 kBProgress (1): 160 kBProgress (1): 168 kBProgress (1): 177 kBProgress (1): 184 kBProgress (1): 191 kBProgress (1): 199 kBProgress (1): 204 kBProgress (1): 210 kBProgress (1): 221 kBProgress (1): 227 kBProgress (1): 238 kBProgress (1): 249 kBProgress (1): 257 kBProgress (1): 267 kBProgress (1): 279 kBProgress (1): 288 kBProgress (1): 298 kBProgress (1): 317 kBProgress (1): 328 kBProgress (1): 341 kBProgress (1): 360 kBProgress (1): 366 kBProgress (1): 378 kBProgress (1): 393 kBProgress (1): 403 kBProgress (1): 420 kBProgress (1): 436 kBProgress (1): 448 kBProgress (1): 469 kBProgress (1): 482 kBProgress (1): 489 kBProgress (1): 500 kBProgress (1): 513 kBProgress (1): 520 kBProgress (1): 531 kBProgress (1): 540 kBProgress (1): 548 kBProgress (1): 561 kBProgress (1): 567 kBProgress (1): 577 kBProgress (1): 596 kBProgress (1): 615 kBProgress (1): 628 kBProgress (1): 648 kBProgress (1): 667 kBProgress (1): 679 kBProgress (1): 698 kBProgress (1): 711 kBProgress (1): 720 kBProgress (1): 732 kBProgress (1): 747 kBProgress (1): 758 kBProgress (1): 769 kBProgress (1): 782 kBProgress (1): 790 kBProgress (1): 803 kBProgress (1): 812 kBProgress (1): 817 kBProgress (1): 827 kBProgress (1): 835 kBProgress (1): 839 kBProgress (1): 847 kBProgress (1): 855 kBProgress (1): 861 kBProgress (1): 868 kBProgress (1): 879 kBProgress (1): 887 kBProgress (1): 894 kBProgress (1): 900 kBProgress (1): 906 kBProgress (1): 916 kBProgress (1): 926 kBProgress (1): 934 kBProgress (1): 947 kBProgress (1): 960 kBProgress (1): 968 kBProgress (1): 981 kBProgress (1): 994 kBProgress (1): 1.0 MBProgress (1): 1.0 MBProgress (1): 1.0 MB Downloaded from central: https://repo.maven.apache.org/maven2/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom (1.0 MB at 4.3 MB/s)
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 116, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Struts2 Example [war]
[INFO] Bean Validation [war]
[INFO] Struts 2 Blank Webapp [war]
[INFO] Coding Struts 2 Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom
Progress (1): 7.5/12 kBProgress (1): 8.2/12 kBProgress (1): 12 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom (12 kB at 63 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom
Progress (1): 7.5/38 kBProgress (1): 8.2/38 kBProgress (1): 16/38 kB Progress (1): 23/38 kBProgress (1): 25/38 kBProgress (1): 33/38 kBProgress (1): 38 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom (38 kB at 107 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar
Progress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5 MB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar (1.5 MB at 1.4 MB/s)
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 3,222 records in this update
[INFO] Downloaded 3,222/3,222 (100%)
[INFO] Completed processing batch 1/2 (50%) in 8,493ms
[INFO] Completed processing batch 2/2 (100%) in 543ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (14517 ms)
[INFO] Check for updates complete (28279 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2025-68161
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [ 41.978 s]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 44.465 s
[INFO] Finished at: 2026-03-29T21:59:54Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #180
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/180/display/redirect>
Changes:
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds48 (tmp-22 ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/.git> # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision b8b977ab44ae2658d737e418507559857e627089 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f b8b977ab44ae2658d737e418507559857e627089 # timeout=10
Commit message: "Fix broken login flow in shiro-basic example (#545)"
> git rev-list --no-walk b8b977ab44ae2658d737e418507559857e627089 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins18191637077984736793.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 114, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Apache Struts Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Apache Struts Example [war]
[INFO] Bean Validation [war]
[INFO] Apache Struts Blank Webapp [war]
[INFO] Coding Apache Struts Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Apache Struts Example Application [war]
[INFO] Http Session [war]
[INFO] Apache Struts Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Apache Struts Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Apache Struts Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Apache Struts with Basic Shiro Security Integration [war]
[INFO] Apache Struts with Spring Integration [war]
[INFO] struts-parameter [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Apache Struts Themes [war]
[INFO] Apache Struts Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Apache Struts Examples 2.0.0 [1/48]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts-examples ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 4,452 records in this update
[INFO] Downloaded 4,452/4,452 (100%)
[INFO] Completed processing batch 1/3 (33%) in 7,677ms
[INFO] Completed processing batch 2/3 (67%) in 704ms
[INFO] Completed processing batch 3/3 (100%) in 119ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (9818 ms)
[INFO] Check for updates complete (83670 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Apache Struts Examples:
freemarker-2.3.34.jar (pkg:maven/org.freemarker/freemarker@2.3.34, cpe:2.3:a:apache:freemarker:2.3.34:*:*:*:*:*:*:*) : CVE-2026-84939
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Apache Struts Examples 2.0.0 ....................... FAILURE [01:35 min]
[INFO] Action chaining 2.0.0 .............................. SKIPPED
[INFO] Annotations with Convention Plugin 2.0.0 ........... SKIPPED
[INFO] Basic Apache Struts Example 2.0.0 .................. SKIPPED
[INFO] Bean Validation 2.0.0 .............................. SKIPPED
[INFO] Apache Struts Blank Webapp 2.0.0 ................... SKIPPED
[INFO] Coding Apache Struts Action 2.0.0 .................. SKIPPED
[INFO] Control Tags 2.0.0 ................................. SKIPPED
[INFO] CRUD Example 2.0.0 ................................. SKIPPED
[INFO] Debugging Struts 2.0.0 ............................. SKIPPED
[INFO] Dynamic Url 2.0.0 .................................. SKIPPED
[INFO] Exception handling 2.0.0 ........................... SKIPPED
[INFO] Exclude Parameters 2.0.0 ........................... SKIPPED
[INFO] Expression Cache 2.0.0 ............................. SKIPPED
[INFO] File upload 2.0.0 .................................. SKIPPED
[INFO] Form Processing 2.0.0 .............................. SKIPPED
[INFO] Form Tags 2.0.0 .................................... SKIPPED
[INFO] Form validation 2.0.0 .............................. SKIPPED
[INFO] XML based form validation 2.0.0 .................... SKIPPED
[INFO] Hello World Apache Struts Example Application 2.0.0 SKIPPED
[INFO] Http Session 2.0.0 ................................. SKIPPED
[INFO] Apache Struts Interceptors 2.0.0 ................... SKIPPED
[INFO] jfreechart 2.0.0 ................................... SKIPPED
[INFO] JSON produce/consume 2.0.0 ......................... SKIPPED
[INFO] Customized JSON produce 2.0.0 ...................... SKIPPED
[INFO] Apache Struts Mail Reader Webapp 2.0.0 ............. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Quarkus 2.0.0 ........................ SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Apache Struts with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Apache Struts with Spring Integration 2.0.0 ........ SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes Override 2.0.0 ................ SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts Tags 2.0.0 ............................ SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 01:36 min
[INFO] Finished at: 2026-10-01T22:00:46Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] freemarker-2.3.34.jar (pkg:maven/org.freemarker/freemarker@2.3.34, cpe:2.3:a:apache:freemarker:2.3.34:*:*:*:*:*:*:*): CVE-2026-84939(9.1)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #179
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/179/display/redirect>
Changes:
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds48 (tmp-22 ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/.git> # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision b8b977ab44ae2658d737e418507559857e627089 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f b8b977ab44ae2658d737e418507559857e627089 # timeout=10
Commit message: "Fix broken login flow in shiro-basic example (#545)"
> git rev-list --no-walk b8b977ab44ae2658d737e418507559857e627089 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins11731414156428206314.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 114, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Apache Struts Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Apache Struts Example [war]
[INFO] Bean Validation [war]
[INFO] Apache Struts Blank Webapp [war]
[INFO] Coding Apache Struts Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Apache Struts Example Application [war]
[INFO] Http Session [war]
[INFO] Apache Struts Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Apache Struts Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Apache Struts Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Apache Struts with Basic Shiro Security Integration [war]
[INFO] Apache Struts with Spring Integration [war]
[INFO] struts-parameter [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Apache Struts Themes [war]
[INFO] Apache Struts Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Apache Struts Examples 2.0.0 [1/48]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts-examples ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 22,554 records in this update
[INFO] Downloaded 10,000/22,554 (44%)
[INFO] Downloaded 20,000/22,554 (89%)
[INFO] Downloaded 22,554/22,554 (100%)
[INFO] Completed processing batch 1/12 (8%) in 10,635ms
[INFO] Completed processing batch 2/12 (17%) in 1,678ms
[INFO] Completed processing batch 3/12 (25%) in 1,364ms
[INFO] Completed processing batch 4/12 (33%) in 880ms
[INFO] Completed processing batch 5/12 (42%) in 741ms
[INFO] Completed processing batch 6/12 (50%) in 1,032ms
[INFO] Completed processing batch 7/12 (58%) in 641ms
[INFO] Completed processing batch 8/12 (67%) in 442ms
[INFO] Completed processing batch 9/12 (75%) in 470ms
[INFO] Completed processing batch 10/12 (83%) in 457ms
[INFO] Completed processing batch 11/12 (92%) in 374ms
[INFO] Completed processing batch 12/12 (100%) in 118ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (9479 ms)
[INFO] Check for updates complete (333965 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Apache Struts Examples:
freemarker-2.3.34.jar (pkg:maven/org.freemarker/freemarker@2.3.34, cpe:2.3:a:apache:freemarker:2.3.34:*:*:*:*:*:*:*) : CVE-2026-84939
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Apache Struts Examples 2.0.0 ....................... FAILURE [05:46 min]
[INFO] Action chaining 2.0.0 .............................. SKIPPED
[INFO] Annotations with Convention Plugin 2.0.0 ........... SKIPPED
[INFO] Basic Apache Struts Example 2.0.0 .................. SKIPPED
[INFO] Bean Validation 2.0.0 .............................. SKIPPED
[INFO] Apache Struts Blank Webapp 2.0.0 ................... SKIPPED
[INFO] Coding Apache Struts Action 2.0.0 .................. SKIPPED
[INFO] Control Tags 2.0.0 ................................. SKIPPED
[INFO] CRUD Example 2.0.0 ................................. SKIPPED
[INFO] Debugging Struts 2.0.0 ............................. SKIPPED
[INFO] Dynamic Url 2.0.0 .................................. SKIPPED
[INFO] Exception handling 2.0.0 ........................... SKIPPED
[INFO] Exclude Parameters 2.0.0 ........................... SKIPPED
[INFO] Expression Cache 2.0.0 ............................. SKIPPED
[INFO] File upload 2.0.0 .................................. SKIPPED
[INFO] Form Processing 2.0.0 .............................. SKIPPED
[INFO] Form Tags 2.0.0 .................................... SKIPPED
[INFO] Form validation 2.0.0 .............................. SKIPPED
[INFO] XML based form validation 2.0.0 .................... SKIPPED
[INFO] Hello World Apache Struts Example Application 2.0.0 SKIPPED
[INFO] Http Session 2.0.0 ................................. SKIPPED
[INFO] Apache Struts Interceptors 2.0.0 ................... SKIPPED
[INFO] jfreechart 2.0.0 ................................... SKIPPED
[INFO] JSON produce/consume 2.0.0 ......................... SKIPPED
[INFO] Customized JSON produce 2.0.0 ...................... SKIPPED
[INFO] Apache Struts Mail Reader Webapp 2.0.0 ............. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Quarkus 2.0.0 ........................ SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Apache Struts with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Apache Struts with Spring Integration 2.0.0 ........ SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes Override 2.0.0 ................ SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts Tags 2.0.0 ............................ SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:47 min
[INFO] Finished at: 2026-09-29T22:05:00Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] freemarker-2.3.34.jar (pkg:maven/org.freemarker/freemarker@2.3.34, cpe:2.3:a:apache:freemarker:2.3.34:*:*:*:*:*:*:*): CVE-2026-84939(9.1)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #178
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/178/display/redirect>
Changes:
------------------------------------------
[...truncated 251.66 KiB...]
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json ---
[INFO] Changes detected - recompiling the module! :source
[INFO] Compiling 3 source files with javac [debug target 17] to target/classes
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (258 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Changes detected - recompiling the module! :source
[INFO] Compiling 9 source files with javac [debug target 17] to target/classes
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (249 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Apache Struts Examples 2.0.0 ....................... SUCCESS [ 36.576 s]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 8.579 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 8.897 s]
[INFO] Basic Apache Struts Example 2.0.0 .................. SUCCESS [ 4.890 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 6.422 s]
[INFO] Apache Struts Blank Webapp 2.0.0 ................... SUCCESS [ 8.582 s]
[INFO] Coding Apache Struts Action 2.0.0 .................. SUCCESS [ 4.354 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 4.202 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 4.174 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 4.387 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 4.518 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 4.544 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 4.933 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 4.556 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 4.981 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 4.121 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 3.792 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 4.217 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 4.541 s]
[INFO] Hello World Apache Struts Example Application 2.0.0 SUCCESS [ 4.200 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 3.753 s]
[INFO] Apache Struts Interceptors 2.0.0 ................... SUCCESS [ 4.332 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 5.465 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 5.401 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 4.107 s]
[INFO] Apache Struts Mail Reader Webapp 2.0.0 ............. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Quarkus 2.0.0 ........................ SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Apache Struts with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Apache Struts with Spring Integration 2.0.0 ........ SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes Override 2.0.0 ................ SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts Tags 2.0.0 ............................ SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 02:39 min
[INFO] Finished at: 2026-09-01T22:01:49Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #177
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/177/display/redirect?page=changes>
Changes:
[github] Modernize examples to Apache Struts 7.3.0 (#544)
[github] Build(deps): Bump actions/checkout from 7.0.0 to 7.0.1 (#542)
[github] Build(deps-dev): Bump org.springframework:spring-web in /rest-angular (#543)
[github] Build(deps): Bump org.sitemesh:sitemesh from 3.2.2 to 3.2.3 (#539)
[github] Build(deps): Bump com.fasterxml.jackson:jackson-bom (#538)
[github] Build(deps): Bump log4j2.version from 2.25.4 to 2.26.1 (#537)
[github] Build(deps-dev): Bump org.hibernate.validator:hibernate-validator (#540)
[github] Build(deps): Bump shiro.version from 2.2.1 to 3.0.0 (#536)
[github] Fix broken login flow in shiro-basic example (#545)
------------------------------------------
[...truncated 253.77 KiB...]
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/main/webapp]>
[INFO] deleting outdated resource WEB-INF/lib/struts2-json-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-config-browser-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/log4j-core-2.25.4.jar
[INFO] deleting outdated resource WEB-INF/lib/log4j-api-2.25.4.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-velocity-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-core-7.2.1.jar
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (302 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] deleting outdated resource WEB-INF/lib/struts2-json-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-config-browser-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/log4j-core-2.25.4.jar
[INFO] deleting outdated resource WEB-INF/lib/log4j-api-2.25.4.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-velocity-plugin-7.2.1.jar
[INFO] deleting outdated resource WEB-INF/lib/struts2-core-7.2.1.jar
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (250 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Apache Struts Examples 2.0.0 ....................... SUCCESS [ 41.528 s]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 7.218 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 9.528 s]
[INFO] Basic Apache Struts Example 2.0.0 .................. SUCCESS [ 4.532 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 5.558 s]
[INFO] Apache Struts Blank Webapp 2.0.0 ................... SUCCESS [ 7.979 s]
[INFO] Coding Apache Struts Action 2.0.0 .................. SUCCESS [ 4.031 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 4.060 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 4.727 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 4.400 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 4.090 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 4.271 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 4.373 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 4.232 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 4.292 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 4.184 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 4.288 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 4.215 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 4.368 s]
[INFO] Hello World Apache Struts Example Application 2.0.0 SUCCESS [ 4.416 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 4.038 s]
[INFO] Apache Struts Interceptors 2.0.0 ................... SUCCESS [ 4.139 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 5.028 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 5.163 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 4.474 s]
[INFO] Apache Struts Mail Reader Webapp 2.0.0 ............. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Quarkus 2.0.0 ........................ SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Apache Struts with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Apache Struts with Spring Integration 2.0.0 ........ SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes 2.0.0 ......................... SKIPPED
[INFO] Apache Struts Themes Override 2.0.0 ................ SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts Tags 2.0.0 ............................ SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 02:39 min
[INFO] Finished at: 2026-08-29T22:01:51Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #176
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/176/display/redirect>
Changes:
------------------------------------------
[...truncated 323.14 KiB...]
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (253 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in JSON produce/consume:
log4j-core-2.25.4.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4, cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*) : CVE-2026-49844
See the dependency-check report for more details.
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Progress (1): 1.2 kBProgress (1): 3.2 kBProgress (1): 6.0 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom (6.0 kB at 87 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Progress (1): 0.9/92 kBProgress (1): 2.3/92 kBProgress (1): 3.6/92 kBProgress (1): 5.0/92 kBProgress (1): 6.4/92 kBProgress (1): 7.7/92 kBProgress (1): 9.1/92 kBProgress (1): 10/92 kB Progress (1): 12/92 kBProgress (1): 13/92 kBProgress (1): 15/92 kBProgress (1): 16/92 kBProgress (1): 17/92 kBProgress (1): 19/92 kBProgress (1): 20/92 kBProgress (1): 21/92 kBProgress (1): 23/92 kBProgress (1): 24/92 kBProgress (1): 25/92 kBProgress (1): 27/92 kBProgress (1): 28/92 kBProgress (1): 30/92 kBProgress (1): 31/92 kBProgress (1): 32/92 kBProgress (1): 34/92 kBProgress (1): 35/92 kBProgress (1): 36/92 kBProgress (1): 38/92 kBProgress (1): 39/92 kBProgress (1): 41/92 kBProgress (1): 42/92 kBProgress (1): 43/92 kBProgress (1): 45/92 kBProgress (1): 46/92 kBProgress (1): 47/92 kBProgress (1): 49/92 kBProgress (1): 50/92 kBProgress (1): 51/92 kBProgress (1): 56/92 kBProgress (1): 60/92 kBProgress (1): 64/92 kBProgress (1): 68/92 kBProgress (1): 73/92 kBProgress (1): 77/92 kBProgress (1): 81/92 kBProgress (1): 85/92 kBProgress (1): 90/92 kBProgress (1): 92 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar (92 kB at 2.9 MB/s)
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Changes detected - recompiling the module! :source
[INFO] Compiling 9 source files with javac [debug target 17] to target/classes
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (313 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
log4j-core-2.25.4.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4, cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*) : CVE-2026-49844
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Struts 2 Examples 2.0.0 ............................ SUCCESS [18:55 min]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 7.388 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 7.818 s]
[INFO] Basic Struts2 Example 2.0.0 ........................ SUCCESS [ 4.124 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 5.483 s]
[INFO] Struts 2 Blank Webapp 2.0.0 ........................ SUCCESS [ 9.158 s]
[INFO] Coding Struts 2 Action 2.0.0 ....................... SUCCESS [ 4.151 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 3.920 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 4.405 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 3.952 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 3.823 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 4.017 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 3.989 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 3.786 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 4.133 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 3.817 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 4.054 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 4.105 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 4.101 s]
[INFO] Hello World Struts 2 Example Application 2.0.0 ..... SUCCESS [ 3.766 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 3.858 s]
[INFO] Struts 2 Interceptors 2.0.0 ........................ SUCCESS [ 4.081 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 4.806 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 4.826 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 5.628 s]
[INFO] Struts 2 Mail Reader Webapp 2.0.0 .................. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Quarkus 2.0.0 ............................. SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Struts2 with Spring Integration 2.0.0 .............. SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Themes 2.0.0 .............................. SKIPPED
[INFO] Struts 2 Themes Override 2.0.0 ..................... SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts 2 Tags 2.0.0 .......................... SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 20:49 min
[INFO] Finished at: 2026-08-01T22:20:00Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #175
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/175/display/redirect?page=changes>
Changes:
[github] Build(deps): Bump struts2.version from 7.1.1 to 7.2.1 (#529)
[github] Build(deps): Bump org.apache.shiro:shiro-core in /shiro-basic (#524)
[github] Build(deps-dev): Bump org.apache.maven.plugins:maven-war-plugin (#525)
[github] Build(deps): Bump actions/checkout from 6.0.2 to 7.0.0 (#527)
[github] Build(deps): Bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.2 (#530)
[github] Build(deps): Bump actions/cache from 5.0.3 to 6.1.0 (#532)
[github] Build(deps-dev): Bump org.apache.maven.plugins:maven-failsafe-plugin (#531)
[github] Build(deps): Bump jackson.version from 2.14.1 to 2.22.0 (#526)
[github] WW-5416 fix: restore default struts.action.extension in examples (#541)
------------------------------------------
[...truncated 257.73 KiB...]
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (300 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (3 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in JSON produce/consume:
log4j-core-2.25.4.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4, cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*) : CVE-2026-49844
See the dependency-check report for more details.
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Progress (1): 1.2 kBProgress (1): 3.2 kBProgress (1): 6.0 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom (6.0 kB at 63 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Progress (1): 0.9/92 kBProgress (1): 2.3/92 kBProgress (1): 3.6/92 kBProgress (1): 5.0/92 kBProgress (1): 6.4/92 kBProgress (1): 7.7/92 kBProgress (1): 8.2/92 kBProgress (1): 9.6/92 kBProgress (1): 11/92 kB Progress (1): 12/92 kBProgress (1): 14/92 kBProgress (1): 15/92 kBProgress (1): 16/92 kBProgress (1): 18/92 kBProgress (1): 19/92 kBProgress (1): 21/92 kBProgress (1): 22/92 kBProgress (1): 23/92 kBProgress (1): 25/92 kBProgress (1): 26/92 kBProgress (1): 27/92 kBProgress (1): 29/92 kBProgress (1): 30/92 kBProgress (1): 31/92 kBProgress (1): 33/92 kBProgress (1): 34/92 kBProgress (1): 36/92 kBProgress (1): 37/92 kBProgress (1): 38/92 kBProgress (1): 40/92 kBProgress (1): 41/92 kBProgress (1): 42/92 kBProgress (1): 44/92 kBProgress (1): 45/92 kBProgress (1): 46/92 kBProgress (1): 48/92 kBProgress (1): 49/92 kBProgress (1): 51/92 kBProgress (1): 55/92 kBProgress (1): 59/92 kBProgress (1): 63/92 kBProgress (1): 67/92 kBProgress (1): 72/92 kBProgress (1): 76/92 kBProgress (1): 80/92 kBProgress (1): 84/92 kBProgress (1): 89/92 kBProgress (1): 92 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar (92 kB at 2.2 MB/s)
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Changes detected - recompiling the module! :source
[INFO] Compiling 9 source files with javac [debug target 17] to target/classes
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.5.1:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (295 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (3 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
log4j-core-2.25.4.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4, cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*) : CVE-2026-49844
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Struts 2 Examples 2.0.0 ............................ SUCCESS [ 54.058 s]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 9.824 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 10.048 s]
[INFO] Basic Struts2 Example 2.0.0 ........................ SUCCESS [ 6.556 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 8.414 s]
[INFO] Struts 2 Blank Webapp 2.0.0 ........................ SUCCESS [ 10.687 s]
[INFO] Coding Struts 2 Action 2.0.0 ....................... SUCCESS [ 5.894 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 6.155 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 6.289 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 6.086 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 5.521 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 6.004 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 6.225 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 5.688 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 5.457 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 5.430 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 5.480 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 5.705 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 5.858 s]
[INFO] Hello World Struts 2 Example Application 2.0.0 ..... SUCCESS [ 5.332 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 5.198 s]
[INFO] Struts 2 Interceptors 2.0.0 ........................ SUCCESS [ 5.587 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 6.129 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 7.022 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 7.117 s]
[INFO] Struts 2 Mail Reader Webapp 2.0.0 .................. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Quarkus 2.0.0 ............................. SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Struts2 with Spring Integration 2.0.0 .............. SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Themes 2.0.0 .............................. SKIPPED
[INFO] Struts 2 Themes Override 2.0.0 ..................... SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts 2 Tags 2.0.0 .......................... SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 03:32 min
[INFO] Finished at: 2026-07-29T22:02:44Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #174
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/174/display/redirect>
Changes:
------------------------------------------
[...truncated 227.18 KiB...]
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.4.0:war (default-war) @ json ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ json ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (267 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.4.0:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (371 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Struts 2 Examples 2.0.0 ............................ SUCCESS [ 56.945 s]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 6.348 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 4.554 s]
[INFO] Basic Struts2 Example 2.0.0 ........................ SUCCESS [ 4.537 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 5.134 s]
[INFO] Struts 2 Blank Webapp 2.0.0 ........................ SUCCESS [ 7.587 s]
[INFO] Coding Struts 2 Action 2.0.0 ....................... SUCCESS [ 4.498 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 5.131 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 4.404 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 4.670 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 4.984 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 4.541 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 4.043 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 4.356 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 4.269 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 4.347 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 4.846 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 4.616 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 4.310 s]
[INFO] Hello World Struts 2 Example Application 2.0.0 ..... SUCCESS [ 4.341 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 4.518 s]
[INFO] Struts 2 Interceptors 2.0.0 ........................ SUCCESS [ 5.034 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 4.361 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 4.341 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 5.161 s]
[INFO] Struts 2 Mail Reader Webapp 2.0.0 .................. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Quarkus 2.0.0 ............................. SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Struts2 with Spring Integration 2.0.0 .............. SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Themes 2.0.0 .............................. SKIPPED
[INFO] Struts 2 Themes Override 2.0.0 ..................... SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts 2 Tags 2.0.0 .......................... SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 02:52 min
[INFO] Finished at: 2026-07-01T22:02:01Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.9:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #173
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/173/display/redirect?page=changes>
Changes:
[Lukasz Lenart] Defines a new struts-parameter example app to show how @StrutsParameter works
[github] Build(deps-dev): Bump com.jayway.jsonpath:json-path in /rest-angular (#509)
[github] Build(deps): Bump org.owasp:dependency-check-maven from 12.1.8 to 12.1.9 (#511)
[github] Build(deps): Bump jakarta.validation:jakarta.validation-api (#512)
[github] Build(deps): Bump org.sitemesh:sitemesh from 3.2.1 to 3.2.2 (#513)
[github] Build(deps): Bump actions/checkout from 6.0.0 to 6.0.2 (#518)
[github] Build(deps): Bump actions/cache from 4.3.0 to 5.0.3 (#519)
[github] Build(deps): Bump org.apache.shiro:shiro-core in /shiro-basic (#520)
[github] Build(deps-dev): Bump com.jayway.jsonpath:json-path from 2.9.0 to 3.0.0 (#510)
[github] Build(deps): Bump org.apache.logging.log4j:log4j-core (#523)
[github] [INFRA] Set up default rulesets for default and release branches (#521)
[github] Build(deps): Bump org.apache.struts:struts2-core from 7.0.3 to 7.1.1 (#508)
------------------------------------------
[...truncated 290.73 KiB...]
[INFO] --- surefire:3.1.2:test (default-test) @ json ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.4.0:war (default-war) @ json ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/json-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ json ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (233 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json/target/dependency-check-report.html>
[INFO]
[INFO] ------------------< org.apache.struts:json-customize >------------------
[INFO] Building Customized JSON produce 2.0.0 [25/48]
[INFO] from json-customize/pom.xml
[INFO] --------------------------------[ war ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom
Progress (1): 1.2 kBProgress (1): 3.2 kBProgress (1): 6.0 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.pom (6.0 kB at 45 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Downloading from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar
Progress (1): 0.9/92 kBProgress (1): 2.3/92 kBProgress (1): 3.6/92 kBProgress (1): 5.0/92 kBProgress (1): 6.4/92 kBProgress (1): 7.7/92 kBProgress (1): 9.1/92 kBProgress (1): 10/92 kB Progress (1): 12/92 kBProgress (1): 13/92 kBProgress (1): 15/92 kBProgress (1): 16/92 kBProgress (1): 17/92 kBProgress (1): 19/92 kBProgress (1): 20/92 kBProgress (1): 21/92 kBProgress (1): 23/92 kBProgress (1): 24/92 kBProgress (1): 25/92 kBProgress (1): 27/92 kBProgress (1): 28/92 kBProgress (1): 30/92 kBProgress (1): 31/92 kBProgress (1): 32/92 kBProgress (1): 34/92 kBProgress (1): 35/92 kBProgress (1): 36/92 kBProgress (1): 38/92 kBProgress (1): 39/92 kBProgress (1): 41/92 kBProgress (1): 42/92 kBProgress (1): 43/92 kBProgress (1): 45/92 kBProgress (1): 46/92 kBProgress (1): 47/92 kBProgress (1): 49/92 kBProgress (1): 50/92 kBProgress (1): 51/92 kBProgress (1): 56/92 kBProgress (1): 60/92 kBProgress (1): 64/92 kBProgress (1): 68/92 kBProgress (1): 73/92 kBProgress (1): 77/92 kBProgress (1): 81/92 kBProgress (1): 85/92 kBProgress (1): 90/92 kBProgress (1): 92 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/flexjson/flexjson/3.3/flexjson-3.3.jar (92 kB at 2.2 MB/s)
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ json-customize ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ json-customize ---
[INFO] Changes detected - recompiling the module! :source
[INFO] Compiling 9 source files with javac [debug target 17] to target/classes
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ json-customize ---
[INFO] skip non existing resourceDirectory <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/test/resources>
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ json-customize ---
[INFO] No sources to compile
[INFO]
[INFO] --- surefire:3.1.2:test (default-test) @ json-customize ---
[INFO] No tests to run.
[INFO]
[INFO] --- war:3.4.0:war (default-war) @ json-customize ---
[INFO] Packaging webapp
[INFO] Assembling webapp [json-customize] in [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0]>
[INFO] Processing war project
[INFO] Copying webapp resources [<https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/src/main/webapp]>
[INFO] Building war: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/json-customize-2.0.0.war>
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ json-customize ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (246 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/json-customize/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Customized JSON produce:
flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*) : CVE-2023-34609
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Struts 2 Examples 2.0.0 ............................ SUCCESS [ 23:30 h]
[INFO] Action chaining 2.0.0 .............................. SUCCESS [ 6.058 s]
[INFO] Annotations with Convention Plugin 2.0.0 ........... SUCCESS [ 7.674 s]
[INFO] Basic Struts2 Example 2.0.0 ........................ SUCCESS [ 4.045 s]
[INFO] Bean Validation 2.0.0 .............................. SUCCESS [ 5.211 s]
[INFO] Struts 2 Blank Webapp 2.0.0 ........................ SUCCESS [ 7.918 s]
[INFO] Coding Struts 2 Action 2.0.0 ....................... SUCCESS [ 3.949 s]
[INFO] Control Tags 2.0.0 ................................. SUCCESS [ 4.229 s]
[INFO] CRUD Example 2.0.0 ................................. SUCCESS [ 4.387 s]
[INFO] Debugging Struts 2.0.0 ............................. SUCCESS [ 3.959 s]
[INFO] Dynamic Url 2.0.0 .................................. SUCCESS [ 4.086 s]
[INFO] Exception handling 2.0.0 ........................... SUCCESS [ 3.938 s]
[INFO] Exclude Parameters 2.0.0 ........................... SUCCESS [ 4.092 s]
[INFO] Expression Cache 2.0.0 ............................. SUCCESS [ 4.067 s]
[INFO] File upload 2.0.0 .................................. SUCCESS [ 3.887 s]
[INFO] Form Processing 2.0.0 .............................. SUCCESS [ 4.086 s]
[INFO] Form Tags 2.0.0 .................................... SUCCESS [ 3.898 s]
[INFO] Form validation 2.0.0 .............................. SUCCESS [ 3.817 s]
[INFO] XML based form validation 2.0.0 .................... SUCCESS [ 3.892 s]
[INFO] Hello World Struts 2 Example Application 2.0.0 ..... SUCCESS [ 4.200 s]
[INFO] Http Session 2.0.0 ................................. SUCCESS [ 3.953 s]
[INFO] Struts 2 Interceptors 2.0.0 ........................ SUCCESS [ 3.684 s]
[INFO] jfreechart 2.0.0 ................................... SUCCESS [ 5.014 s]
[INFO] JSON produce/consume 2.0.0 ......................... SUCCESS [ 5.054 s]
[INFO] Customized JSON produce 2.0.0 ...................... FAILURE [ 5.612 s]
[INFO] Struts 2 Mail Reader Webapp 2.0.0 .................. SKIPPED
[INFO] Message resource 2.0.0 ............................. SKIPPED
[INFO] Message Store 2.0.0 ................................ SKIPPED
[INFO] Preparable Interface 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Quarkus 2.0.0 ............................. SKIPPED
[INFO] REST to Action Mapper Example Application 2.0.0 .... SKIPPED
[INFO] REST Plugin based application with AngularJS 2.0.0 . SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration 2.0.0 SKIPPED
[INFO] Struts2 with Spring Integration 2.0.0 .............. SKIPPED
[INFO] struts-parameter 1.0-SNAPSHOT ...................... SKIPPED
[INFO] Custom TextProvider 2.0.0 .......................... SKIPPED
[INFO] Struts Tiles Example 2.0.0 ......................... SKIPPED
[INFO] Struts 2 Themes 2.0.0 .............................. SKIPPED
[INFO] Struts 2 Themes Override 2.0.0 ..................... SKIPPED
[INFO] Type Conversion 2.0.0 .............................. SKIPPED
[INFO] Unit Testing 2.0.0 ................................. SKIPPED
[INFO] Unknown handler 2.0.0 .............................. SKIPPED
[INFO] Using Struts 2 Tags 2.0.0 .......................... SKIPPED
[INFO] validation-messages 2.0.0 .......................... SKIPPED
[INFO] Wildcard Method Selection 2.0.0 .................... SKIPPED
[INFO] Wildcard RegEx pattern matching 2.0.0 .............. SKIPPED
[INFO] JasperReports Tutorial 2.0.0 ....................... SKIPPED
[INFO] Struts Sitemesh 3 Example 2.0.0 .................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 23:32 h
[INFO] Finished at: 2026-06-30T21:31:46Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.9:check (default) on project json-customize:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] flexjson-3.3.jar (pkg:maven/net.sf.flexjson/flexjson@3.3, cpe:2.3:a:flexjson_project:flexjson:3.3:*:*:*:*:*:*:*): CVE-2023-34609(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :json-customize
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #172
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/172/display/redirect>
Changes:
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds38 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
Cloning the remote Git repository
Cloning repository https://gitbox.apache.org/repos/asf/struts-examples.git
> git init <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/> # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
Avoid second fetch
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Commit message: "Merge pull request #507 from apache/dependabot/github_actions/actions/checkout-6.0.0"
> git rev-list --no-walk 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins11144067385282646578.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 116, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Struts2 Example [war]
[INFO] Bean Validation [war]
[INFO] Struts 2 Blank Webapp [war]
[INFO] Coding Struts 2 Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 1,135 records in this update
[INFO] Downloaded 1,135/1,135 (100%)
[INFO] Completed processing batch 1/1 (100%) in 3,164ms
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Begin database defrag
[INFO] End database defrag (16350 ms)
[INFO] Check for updates complete (23448 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-api-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-api@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34479, CVE-2026-34477
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2025-68161, CVE-2026-34477
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [ 36.626 s]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 37.301 s
[INFO] Finished at: 2026-06-01T21:59:48Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] log4j-api-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-api@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34479(6.9)
[ERROR] log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34478(6.9), CVE-2026-34480(6.9), CVE-2026-34479(6.9)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #171
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/171/display/redirect>
Changes:
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds29 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
Cloning the remote Git repository
Cloning repository https://gitbox.apache.org/repos/asf/struts-examples.git
> git init <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/> # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
Avoid second fetch
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Commit message: "Merge pull request #507 from apache/dependabot/github_actions/actions/checkout-6.0.0"
> git rev-list --no-walk 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins4557967526594180667.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 116, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Struts2 Example [war]
[INFO] Bean Validation [war]
[INFO] Struts 2 Blank Webapp [war]
[INFO] Coding Struts 2 Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (1356 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (8 seconds)
[INFO] Finished CPE Analyzer (11 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (13 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-api-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-api@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34479, CVE-2026-34477
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2025-68161, CVE-2026-34477
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [ 23.756 s]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 24.600 s
[INFO] Finished at: 2026-05-29T21:59:38Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] log4j-api-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-api@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34479(6.9)
[ERROR] log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34478(6.9), CVE-2026-34480(6.9), CVE-2026-34479(6.9)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #170
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/170/display/redirect>
Changes:
------------------------------------------
[...truncated 6.47 KiB...]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom
Progress (1): 7.5/12 kBProgress (1): 8.2/12 kBProgress (1): 12 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom (12 kB at 63 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom
Progress (1): 7.5/38 kBProgress (1): 8.2/38 kBProgress (1): 16/38 kB Progress (1): 23/38 kBProgress (1): 25/38 kBProgress (1): 33/38 kBProgress (1): 38 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom (38 kB at 106 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar
Progress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5 MB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar (1.5 MB at 1.2 MB/s)
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
Downloading from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.1.8/dependency-check-core-12.1.8.pom
Progress (1): 716 BProgress (1): 1.6 kBProgress (1): 5.0 kBProgress (1): 9.5 kBProgress (1): 13 kB Progress (1): 17 kBProgress (1): 22 kBProgress (1): 24 kBProgress (1): 31 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.1.8/dependency-check-core-12.1.8.pom (31 kB at 1.1 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.1.8/dependency-check-utils-12.1.8.pom
Progress (1): 745 BProgress (1): 2.0 kBProgress (1): 5.3 kBProgress (1): 6.2 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.1.8/dependency-check-utils-12.1.8.pom (6.2 kB at 240 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs-annotations/4.9.6/spotbugs-annotations-4.9.6.pom
Progress (1): 951 BProgress (1): 3.1 kBProgress (1): 3.5 kB Downloaded from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs-annotations/4.9.6/spotbugs-annotations-4.9.6.pom (3.5 kB at 128 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.1.8/dependency-check-core-12.1.8.jar
Progress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.1/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.2/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.3/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.4/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.5/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.6/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.7/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.8/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 0.9/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.0/1.1 MBProgress (1): 1.1/1.1 MBProgress (1): 1.1 MB Downloaded from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.1.8/dependency-check-core-12.1.8.jar (1.1 MB at 10 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.1.8/dependency-check-utils-12.1.8.jar
Downloading from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs-annotations/4.9.6/spotbugs-annotations-4.9.6.jar
Progress (1): 7.7/16 kBProgress (1): 16/16 kB Progress (1): 16 kB Downloaded from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs-annotations/4.9.6/spotbugs-annotations-4.9.6.jar (16 kB at 647 kB/s)
Progress (1): 0.9/59 kBProgress (1): 2.3/59 kBProgress (1): 3.6/59 kBProgress (1): 5.0/59 kBProgress (1): 6.4/59 kBProgress (1): 7.7/59 kBProgress (1): 9.1/59 kBProgress (1): 10/59 kB Progress (1): 12/59 kBProgress (1): 13/59 kBProgress (1): 15/59 kBProgress (1): 16/59 kBProgress (1): 17/59 kBProgress (1): 19/59 kBProgress (1): 20/59 kBProgress (1): 21/59 kBProgress (1): 23/59 kBProgress (1): 24/59 kBProgress (1): 26/59 kBProgress (1): 27/59 kBProgress (1): 28/59 kBProgress (1): 30/59 kBProgress (1): 31/59 kBProgress (1): 32/59 kBProgress (1): 33/59 kBProgress (1): 34/59 kBProgress (1): 36/59 kBProgress (1): 37/59 kBProgress (1): 38/59 kBProgress (1): 40/59 kBProgress (1): 41/59 kBProgress (1): 42/59 kBProgress (1): 44/59 kBProgress (1): 45/59 kBProgress (1): 46/59 kBProgress (1): 48/59 kBProgress (1): 49/59 kBProgress (1): 51/59 kBProgress (1): 52/59 kBProgress (1): 53/59 kBProgress (1): 55/59 kBProgress (1): 59 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.1.8/dependency-check-utils-12.1.8.jar (59 kB at 650 kB/s)
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 32,029 records in this update
[INFO] Downloaded 10,000/32,029 (31%)
[INFO] Downloaded 20,000/32,029 (62%)
[INFO] Downloaded 30,000/32,029 (94%)
[ERROR] Failed to process CVE-2026-6785
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2026-6785'; Value too long for column "URL CHARACTER VARYING(1000)": "'https://bugzilla.mozilla.org/buglist.cgi?bug_id=1935995%2C1999158%2C2015952%2C2... (1585)"; SQL statement:
INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?) [22001-232]
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1104)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
at java.util.concurrent.FutureTask.run (FutureTask.java:264)
at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1136)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:635)
at java.lang.Thread.run (Thread.java:840)
[ERROR] Failed to process CVE-2026-6786
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2026-6786'; Value too long for column "URL CHARACTER VARYING(1000)": "'https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2... (1115)"; SQL statement:
INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?) [22001-232]
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1104)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
at java.util.concurrent.FutureTask.run (FutureTask.java:264)
at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1136)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:635)
at java.lang.Thread.run (Thread.java:840)
[INFO] Downloaded 32,029/32,029 (100%)
[INFO] Completed processing batch 1/17 (6%) in 12,391ms
[INFO] Completed processing batch 2/17 (12%) in 6,558ms
[INFO] Completed processing batch 3/17 (18%) in 6,117ms
[INFO] Completed processing batch 4/17 (24%) in 5,903ms
[INFO] Completed processing batch 5/17 (29%) in 5,354ms
[INFO] Completed processing batch 6/17 (35%) in 5,413ms
[INFO] Completed processing batch 7/17 (41%) in 5,383ms
[INFO] Completed processing batch 8/17 (47%) in 5,345ms
[INFO] Completed processing batch 9/17 (53%) in 5,207ms
[INFO] Completed processing batch 10/17 (59%) in 4,392ms
[INFO] Completed processing batch 11/17 (65%) in 2,516ms
[INFO] Completed processing batch 12/17 (71%) in 1,499ms
[INFO] Completed processing batch 13/17 (76%) in 1,793ms
[INFO] Completed processing batch 14/17 (82%) in 1,392ms
[INFO] Completed processing batch 15/17 (88%) in 604ms
[INFO] Completed processing batch 16/17 (94%) in 704ms
[INFO] Completed processing batch 17/17 (100%) in 32ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (16982 ms)
[INFO] Check for updates complete (181057 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34478, CVE-2026-34480, CVE-2025-68161, CVE-2026-34481
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [03:14 min]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 03:17 min
[INFO] Finished at: 2026-05-01T22:02:28Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34478(6.9), CVE-2026-34480(6.9), CVE-2026-34481(6.3)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #169
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/169/display/redirect>
Changes:
------------------------------------------
[...truncated 5.30 KiB...]
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Struts2 Example [war]
[INFO] Bean Validation [war]
[INFO] Struts 2 Blank Webapp [war]
[INFO] Coding Struts 2 Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-04-28T15%3A16%3A37Z&lastModEndDate=2026-08-26T15%3A16%3A37Z&resultsPerPage=2000&startIndex=0 : 2nd time
[INFO] NVD API has 28,601 records in this update
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-04-28T15%3A16%3A37Z&lastModEndDate=2026-08-26T15%3A16%3A37Z&resultsPerPage=2000&startIndex=4000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-04-28T15%3A16%3A37Z&lastModEndDate=2026-08-26T15%3A16%3A37Z&resultsPerPage=2000&startIndex=4000 : 3rd time
[INFO] Downloaded 10,000/28,612 (35%)
[INFO] Downloaded 20,000/28,618 (70%)
[INFO] Downloaded 28,618/28,618 (100%)
[INFO] Completed processing batch 1/15 (7%) in 9,861ms
[INFO] Completed processing batch 2/15 (13%) in 7,382ms
[INFO] Completed processing batch 3/15 (20%) in 6,143ms
[INFO] Completed processing batch 4/15 (27%) in 5,684ms
[INFO] Completed processing batch 5/15 (33%) in 5,101ms
[INFO] Completed processing batch 6/15 (40%) in 5,387ms
[INFO] Completed processing batch 7/15 (47%) in 5,552ms
[INFO] Completed processing batch 8/15 (53%) in 4,975ms
[INFO] Completed processing batch 9/15 (60%) in 4,432ms
[INFO] Completed processing batch 10/15 (67%) in 4,757ms
[INFO] Completed processing batch 11/15 (73%) in 4,084ms
[INFO] Completed processing batch 12/15 (80%) in 1,706ms
[INFO] Completed processing batch 13/15 (87%) in 1,965ms
[INFO] Completed processing batch 14/15 (93%) in 1,134ms
[ERROR] Failed to process CVE-2026-6785
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2026-6785'; Value too long for column "URL CHARACTER VARYING(1000)": "'https://bugzilla.mozilla.org/buglist.cgi?bug_id=1935995%2C1999158%2C2015952%2C2... (1585)"; SQL statement:
INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?) [22001-232]
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1104)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
at java.util.concurrent.FutureTask.run (FutureTask.java:264)
at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1136)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:635)
at java.lang.Thread.run (Thread.java:840)
[ERROR] Failed to process CVE-2026-6786
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2026-6786'; Value too long for column "URL CHARACTER VARYING(1000)": "'https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2... (1115)"; SQL statement:
INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?) [22001-232]
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1104)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
at java.util.concurrent.FutureTask.run (FutureTask.java:264)
at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1136)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:635)
at java.lang.Thread.run (Thread.java:840)
[INFO] Completed processing batch 15/15 (100%) in 234ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (12357 ms)
[INFO] Check for updates complete (3015621 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2026-34478, CVE-2026-34480, CVE-2025-68161, CVE-2026-34481
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [50:44 min]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 50:47 min
[INFO] Finished at: 2026-04-29T22:49:59Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*): CVE-2026-34478(6.9), CVE-2026-34480(6.9), CVE-2026-34481(6.3)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-examples-dependency-check #168
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/168/display/redirect>
Changes:
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds29 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
Cloning the remote Git repository
Cloning repository https://gitbox.apache.org/repos/asf/struts-examples.git
> git init <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/> # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts-examples.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts-examples.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts-examples.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
Avoid second fetch
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Commit message: "Merge pull request #507 from apache/dependabot/github_actions/actions/checkout-6.0.0"
> git rev-list --no-walk 9293ef31a9fc751e8f392b96953d43a8f4e0bcc0 # timeout=10
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-examples-dependency-check] $ /bin/sh -xe /tmp/jenkins7923142263288250856.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ export PATH=/home/jenkins/tools/maven/latest3:/home/jenkins/tools/java/latest17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+ ./mvnw verify -Pdependency-check
[INFO] Scanning for projects...
Downloading from apache-public: https://repository.apache.org/content/groups/public/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from apache-staging: https://repository.apache.org/content/groups/staging/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from apache-snapshots: https://repository.apache.org/content/groups/snapshots/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from oss-snapshots: https://oss.sonatype.org/content/repositories/snapshots/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Downloading from central: https://repo.maven.apache.org/maven2/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom
Progress (1): 789 BProgress (1): 2.0 kBProgress (1): 7.8 kBProgress (1): 14 kB Progress (1): 19 kBProgress (1): 32 kBProgress (1): 39 kBProgress (1): 47 kBProgress (1): 57 kBProgress (1): 67 kBProgress (1): 74 kBProgress (1): 86 kBProgress (1): 98 kBProgress (1): 105 kBProgress (1): 115 kBProgress (1): 126 kBProgress (1): 133 kBProgress (1): 146 kBProgress (1): 153 kBProgress (1): 159 kBProgress (1): 168 kBProgress (1): 177 kBProgress (1): 183 kBProgress (1): 191 kBProgress (1): 199 kBProgress (1): 204 kBProgress (1): 209 kBProgress (1): 221 kBProgress (1): 227 kBProgress (1): 237 kBProgress (1): 249 kBProgress (1): 256 kBProgress (1): 266 kBProgress (1): 279 kBProgress (1): 288 kBProgress (1): 298 kBProgress (1): 316 kBProgress (1): 328 kBProgress (1): 341 kBProgress (1): 359 kBProgress (1): 366 kBProgress (1): 378 kBProgress (1): 393 kBProgress (1): 402 kBProgress (1): 420 kBProgress (1): 436 kBProgress (1): 448 kBProgress (1): 468 kBProgress (1): 481 kBProgress (1): 489 kBProgress (1): 500 kBProgress (1): 512 kBProgress (1): 519 kBProgress (1): 531 kBProgress (1): 540 kBProgress (1): 547 kBProgress (1): 561 kBProgress (1): 566 kBProgress (1): 576 kBProgress (1): 596 kBProgress (1): 614 kBProgress (1): 628 kBProgress (1): 647 kBProgress (1): 666 kBProgress (1): 679 kBProgress (1): 697 kBProgress (1): 710 kBProgress (1): 720 kBProgress (1): 731 kBProgress (1): 747 kBProgress (1): 757 kBProgress (1): 768 kBProgress (1): 781 kBProgress (1): 790 kBProgress (1): 803 kBProgress (1): 812 kBProgress (1): 817 kBProgress (1): 827 kBProgress (1): 834 kBProgress (1): 839 kBProgress (1): 847 kBProgress (1): 855 kBProgress (1): 861 kBProgress (1): 868 kBProgress (1): 879 kBProgress (1): 886 kBProgress (1): 894 kBProgress (1): 900 kBProgress (1): 905 kBProgress (1): 916 kBProgress (1): 926 kBProgress (1): 934 kBProgress (1): 947 kBProgress (1): 960 kBProgress (1): 968 kBProgress (1): 981 kBProgress (1): 994 kBProgress (1): 1.0 MBProgress (1): 1.0 MBProgress (1): 1.0 MB Downloaded from central: https://repo.maven.apache.org/maven2/io/quarkus/quarkus-universe-bom/3.28.1/quarkus-universe-bom-3.28.1.pom (1.0 MB at 2.7 MB/s)
[WARNING]
[WARNING] Some problems were encountered while building the effective model for org.apache.struts:rest-angular:war:2.0.0
[WARNING] 'build.plugins.plugin.version' for com.cj.jshintmojo:jshint-maven-plugin is missing. @ line 116, column 21
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 Examples [pom]
[INFO] Action chaining [war]
[INFO] Annotations with Convention Plugin [war]
[INFO] Basic Struts2 Example [war]
[INFO] Bean Validation [war]
[INFO] Struts 2 Blank Webapp [war]
[INFO] Coding Struts 2 Action [war]
[INFO] Control Tags [war]
[INFO] CRUD Example [war]
[INFO] Debugging Struts [war]
[INFO] Dynamic Url [war]
[INFO] Exception handling [war]
[INFO] Exclude Parameters [war]
[INFO] Expression Cache [war]
[INFO] File upload [war]
[INFO] Form Processing [war]
[INFO] Form Tags [war]
[INFO] Form validation [war]
[INFO] XML based form validation [war]
[INFO] Hello World Struts 2 Example Application [war]
[INFO] Http Session [war]
[INFO] Struts 2 Interceptors [war]
[INFO] jfreechart [war]
[INFO] JSON produce/consume [war]
[INFO] Customized JSON produce [war]
[INFO] Struts 2 Mail Reader Webapp [war]
[INFO] Message resource [war]
[INFO] Message Store [war]
[INFO] Preparable Interface [war]
[INFO] Struts 2 Quarkus [jar]
[INFO] REST to Action Mapper Example Application [war]
[INFO] REST Plugin based application with AngularJS [war]
[INFO] Struts2 with Basic Shiro Security Integration [war]
[INFO] Struts2 with Spring Integration [war]
[INFO] Custom TextProvider [war]
[INFO] Struts Tiles Example [war]
[INFO] Struts 2 Themes [war]
[INFO] Struts 2 Themes Override [war]
[INFO] Type Conversion [war]
[INFO] Unit Testing [war]
[INFO] Unknown handler [war]
[INFO] Using Struts 2 Tags [war]
[INFO] validation-messages [war]
[INFO] Wildcard Method Selection [war]
[INFO] Wildcard RegEx pattern matching [war]
[INFO] JasperReports Tutorial [war]
[INFO] Struts Sitemesh 3 Example [war]
[INFO]
[INFO] -----------------< org.apache.struts:struts-examples >------------------
[INFO] Building Struts 2 Examples 2.0.0 [1/47]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom
Progress (1): 7.5/12 kBProgress (1): 8.2/12 kBProgress (1): 12 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.pom (12 kB at 62 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom
Progress (1): 7.5/38 kBProgress (1): 8.2/38 kBProgress (1): 16/38 kB Progress (1): 23/38 kBProgress (1): 25/38 kBProgress (1): 33/38 kBProgress (1): 38 kB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-parent/7.0.3/struts2-parent-7.0.3.pom (38 kB at 105 kB/s)
Downloading from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar
Progress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.1/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.2/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.3/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.4/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.5/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.6/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.7/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.8/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 0.9/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.0/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.1/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.2/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.3/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.4/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5/1.5 MBProgress (1): 1.5 MB Downloaded from apache-public: https://repository.apache.org/content/groups/public/org/apache/struts/struts2-core/7.0.3/struts2-core-7.0.3.jar (1.5 MB at 1.2 MB/s)
[INFO]
[INFO] --- dependency-check:12.1.8:check (default) @ struts-examples ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (767 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (5 seconds)
[INFO] Finished CPE Analyzer (6 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}cve={CVE-2016-1182,CVE-2016-1181,CVE-2014-0114,CVE-2015-0899,CVE-2011-5057,CVE-2012-0391,CVE-2012-0392,CVE-2012-0393,CVE-2012-0394,CVE-2012-0838,CVE-2013-1965,CVE-2013-1966,CVE-2013-2115,CVE-2013-2134,CVE-2013-2135,CVE-2014-0094,CVE-2014-0113,CVE-2015-5169,CVE-2016-0785,CVE-2016-4003,CVE-2015-2992,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2017-1000487,}vulnerabilityName={PropertyType{value=Directory traversal in org.codehaus.plexus.util.Expand, regex=false, caseSensitive=false},PropertyType{value=Possible XML Injection, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/uk\.ltd\.getahead/dwr@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:getahead:direct_web_remoting, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-collections/commons\-collections@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_collections, regex=false, caseSensitive=false},}cve={CVE-2015-6420,CVE-2017-15708,}vulnerabilityName={PropertyType{value=Remote code execution, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/commons\-beanutils/commons\-beanutils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:commons_beanutils, regex=false, caseSensitive=false},}cve={CVE-2014-0114,CVE-2019-10086,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:dom4j_project:dom4j, regex=false, caseSensitive=false},}cve={CVE-2020-10683,CVE-2018-1000632,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.tiles/tiles\-ognl@.*$, regex=true, caseSensitive=false},cve={CVE-2016-3093,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-jdbc-postgresql:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:postgresql:postgresql, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-resteasy.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:resteasy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-undertow.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:redhat:undertow, regex=false, caseSensitive=false},}cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-swagger-ui.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:swagger_project:swagger-ui, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^io\.quarkus:quarkus-netty.*:.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:netty:netty, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.eclipse\.microprofile\.config/microprofile-config-api@.*, regex=true, caseSensitive=false},cve={CVE-2022-37422,CVE-2022-45129,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/io\.quarkus/quarkus-vertx-http@.*, regex=true, caseSensitive=false},cve={CVE-2022-4147,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity@.*, regex=true, caseSensitive=false},cve={CVE-2020-13936,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.velocity/velocity-tools@.*, regex=true, caseSensitive=false},cve={CVE-2020-13959,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@1\.4\.19, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40156,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (8 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-examples-dependency-check/ws/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Examples:
commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*) : CVE-2025-48976
commons-lang3-3.17.0.jar (pkg:maven/org.apache.commons/commons-lang3@3.17.0, cpe:2.3:a:apache:commons_lang:3.17.0:*:*:*:*:*:*:*) : CVE-2025-48924
log4j-core-2.25.1.jar (pkg:maven/org.apache.logging.log4j/log4j-core@2.25.1, cpe:2.3:a:apache:log4j:2.25.1:*:*:*:*:*:*:*) : CVE-2025-68161
struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*) : CVE-2025-66675, CVE-2025-64775
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 Examples 2.0.0:
[INFO]
[INFO] Struts 2 Examples .................................. FAILURE [ 21.348 s]
[INFO] Action chaining .................................... SKIPPED
[INFO] Annotations with Convention Plugin ................. SKIPPED
[INFO] Basic Struts2 Example .............................. SKIPPED
[INFO] Bean Validation .................................... SKIPPED
[INFO] Struts 2 Blank Webapp .............................. SKIPPED
[INFO] Coding Struts 2 Action ............................. SKIPPED
[INFO] Control Tags ....................................... SKIPPED
[INFO] CRUD Example ....................................... SKIPPED
[INFO] Debugging Struts ................................... SKIPPED
[INFO] Dynamic Url ........................................ SKIPPED
[INFO] Exception handling ................................. SKIPPED
[INFO] Exclude Parameters ................................. SKIPPED
[INFO] Expression Cache ................................... SKIPPED
[INFO] File upload ........................................ SKIPPED
[INFO] Form Processing .................................... SKIPPED
[INFO] Form Tags .......................................... SKIPPED
[INFO] Form validation .................................... SKIPPED
[INFO] XML based form validation .......................... SKIPPED
[INFO] Hello World Struts 2 Example Application ........... SKIPPED
[INFO] Http Session ....................................... SKIPPED
[INFO] Struts 2 Interceptors .............................. SKIPPED
[INFO] jfreechart ......................................... SKIPPED
[INFO] JSON produce/consume ............................... SKIPPED
[INFO] Customized JSON produce ............................ SKIPPED
[INFO] Struts 2 Mail Reader Webapp ........................ SKIPPED
[INFO] Message resource ................................... SKIPPED
[INFO] Message Store ...................................... SKIPPED
[INFO] Preparable Interface ............................... SKIPPED
[INFO] Struts 2 Quarkus ................................... SKIPPED
[INFO] REST to Action Mapper Example Application .......... SKIPPED
[INFO] REST Plugin based application with AngularJS ....... SKIPPED
[INFO] Struts2 with Basic Shiro Security Integration ...... SKIPPED
[INFO] Struts2 with Spring Integration .................... SKIPPED
[INFO] Custom TextProvider ................................ SKIPPED
[INFO] Struts Tiles Example ............................... SKIPPED
[INFO] Struts 2 Themes .................................... SKIPPED
[INFO] Struts 2 Themes Override ........................... SKIPPED
[INFO] Type Conversion .................................... SKIPPED
[INFO] Unit Testing ....................................... SKIPPED
[INFO] Unknown handler .................................... SKIPPED
[INFO] Using Struts 2 Tags ................................ SKIPPED
[INFO] validation-messages ................................ SKIPPED
[INFO] Wildcard Method Selection .......................... SKIPPED
[INFO] Wildcard RegEx pattern matching .................... SKIPPED
[INFO] JasperReports Tutorial ............................. SKIPPED
[INFO] Struts Sitemesh 3 Example .......................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 24.705 s
[INFO] Finished at: 2026-04-01T21:59:37Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.8:check (default) on project struts-examples:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] commons-fileupload2-core-2.0.0-M2.jar (pkg:maven/org.apache.commons/commons-fileupload2-core@2.0.0-M2, cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*): CVE-2025-48976(7.5)
[ERROR] struts2-core-7.0.3.jar (pkg:maven/org.apache.struts/struts2-core@7.0.3, cpe:2.3:a:apache:struts:7.0.3:*:*:*:*:*:*:*): CVE-2025-64775(7.5), CVE-2025-66675(8.2)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Build step 'Execute shell' marked build as failure
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3