You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2024/02/01 06:41:21 UTC
Build failed in Jenkins: Struts » Struts-master-dependency-check #202
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/202/display/redirect?page=changes>
Changes:
[git] WW-5352 Introduce StrutsParameter annotation
[git] WW-5352 Introduce ThreadAllowlist bean
[git] WW-5352 First draft implementation
[git] WW-5352 Ensure allowlist is cleared if in unexpected state
[git] WW-5352 Add full unit test coverage
[git] WW-5352 Fix missing curved bracket
[git] WW-5352 Enable annotations for showcase
[git] WW-5352 Dispatcher should up thread allowlist
[git] WW-5352 Reinstate manual allowlist for generic types
[git] WW-5352 Implement auto-allowlisting for Iterator component
[git] WW-5352 Mild optimisation
[git] WW-5352 Auto allowlist parameterized types!
[git] WW-5352 Map-like type support
[git] WW-5352 Add unit test coverage for generics
[git] WW-5352 Implement transition mode
[git] WW-5352 Ensure superclasses and interfaces allowlisted
[git] WW-5352 Add debug logging for parameter rejections
[git] WW-5352 Acceptance test coverage
[git] WW-5352 Normalise parameter name
[Lukasz Lenart] Fixes excluding Plexus container in OWASP scan
[Lukasz Lenart] Drops JDK11 build and fixes duplicated steps
[s.peters] Small spelling and MD fixes (IntelliJ assisted)
[Sebastian.Peters] Mention just the maintenance branches for supported versions
[github] Stops running sonar.yml on forks
[Lukasz Lenart] WW-5360 Introduces additional countStr & indexStr to allow to ignore conversion
[github] Bump actions/upload-artifact from 4.2.0 to 4.3.0
------------------------------------------
[...truncated 6.52 KB...]
[INFO]
[INFO] <<< source:3.2.1:jar (attach-sources) < generate-sources @ struts2-parent <<<
[INFO]
[INFO]
[INFO] --- source:3.2.1:jar (attach-sources) @ struts2-parent ---
[INFO]
[INFO] --- site:3.9.0:attach-descriptor (attach-descriptor) @ struts2-parent ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[INFO]
[INFO] --- dependency-check:8.4.2:check (default) @ struts2-parent ---
[INFO] Checking for updates
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2003.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2003.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2003.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
[ERROR] Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
[ERROR] Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta
org.owasp.dependencycheck.data.update.exception.UpdateException: Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta
at org.owasp.dependencycheck.data.update.NvdCveUpdater.doMetaDownload (NvdCveUpdater.java:410)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile (NvdCveUpdater.java:355)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded (NvdCveUpdater.java:501)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update (NvdCveUpdater.java:133)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1929)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1112)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Download failed, unable to retrieve 'https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta'; Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; unable to connect.
at org.owasp.dependencycheck.utils.Downloader.fetchContent (Downloader.java:187)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.doMetaDownload (NvdCveUpdater.java:381)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile (NvdCveUpdater.java:355)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded (NvdCveUpdater.java:501)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update (NvdCveUpdater.java:133)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1929)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1112)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; unable to connect.
at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection (HttpResourceConnection.java:267)
at org.owasp.dependencycheck.utils.HttpResourceConnection.fetch (HttpResourceConnection.java:163)
at org.owasp.dependencycheck.utils.Downloader.fetchContent (Downloader.java:182)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.doMetaDownload (NvdCveUpdater.java:381)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile (NvdCveUpdater.java:355)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded (NvdCveUpdater.java:501)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update (NvdCveUpdater.java:133)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1929)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1112)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection (HttpResourceConnection.java:249)
at org.owasp.dependencycheck.utils.HttpResourceConnection.fetch (HttpResourceConnection.java:163)
at org.owasp.dependencycheck.utils.Downloader.fetchContent (Downloader.java:182)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.doMetaDownload (NvdCveUpdater.java:381)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile (NvdCveUpdater.java:355)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded (NvdCveUpdater.java:501)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update (NvdCveUpdater.java:133)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1929)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1112)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (8451 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.4.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [02:04 min]
[INFO] Struts 2 Bill of Materials ......................... SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 DWR Plugin ................................ SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 02:06 min
[INFO] Finished at: 2024-02-01T06:41:20Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:8.4.2:check (default) on project struts2-parent: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta
[ERROR] caused by DownloadFailedException: Download failed, unable to retrieve 'https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta'; Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; unable to connect.
[ERROR] caused by DownloadFailedException: Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; unable to connect.
[ERROR] caused by DownloadFailedException: Error retrieving https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta; received response code 503; Service Unavailable
[ERROR] NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #205
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/205/display/redirect?page=changes>
Changes:
[Lukasz Lenart] WW-5401 Improves logging around wrapping request and detecting multipart request
[github] WW-5401 Fixes typo
[github] WW-5401 Uses same message approach
[git] WW-5364 Fix potential NPE in XmlDocConfigurationProvider
------------------------------------------
[...truncated 703.23 KB...]
[INFO]
[INFO] --- resources:3.1.0:resources (default-resources) @ struts2-spring-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 3 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- compiler:3.8.1:compile (default-compile) @ struts2-spring-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 9 source files to <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/classes>
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/com/opensymphony/xwork2/spring/SpringObjectFactory.java>: Some input files use or override a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/com/opensymphony/xwork2/spring/SpringObjectFactory.java>: Recompile with -Xlint:deprecation for details.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java>: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java> uses unchecked or unsafe operations.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java>: Recompile with -Xlint:unchecked for details.
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-spring-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.1.0:testResources (default-testResources) @ struts2-spring-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 4 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- compiler:3.8.1:testCompile (default-testCompile) @ struts2-spring-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 17 source files to <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/test-classes>
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java>: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java> uses or overrides a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java>: Recompile with -Xlint:deprecation for details.
[INFO]
[INFO] --- surefire:3.2.5:test (default-test) @ struts2-spring-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.spring.StrutsSpringObjectFactoryTest
06:46:38.859 [main] FATAL org.apache.struts2.spring.StrutsSpringObjectFactory - ********** FATAL ERROR STARTING UP STRUTS-SPRING INTEGRATION **********
Looks like the Spring listener was not configured for your web app!
Nothing will work until WebApplicationContextUtils returns a valid ApplicationContext.
You might need to add the following to web.xml:
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.770 s -- in org.apache.struts2.spring.StrutsSpringObjectFactoryTest
[INFO] Running com.test.SecurityMemberAccessProxyTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.619 s -- in com.test.SecurityMemberAccessProxyTest
[INFO] Running com.opensymphony.xwork2.ognl.SecurityMemberAccessProxyTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.472 s -- in com.opensymphony.xwork2.ognl.SecurityMemberAccessProxyTest
[INFO] Running com.opensymphony.xwork2.spring.SpringProxyUtilTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.602 s -- in com.opensymphony.xwork2.spring.SpringProxyUtilTest
[INFO] Running com.opensymphony.xwork2.spring.SpringObjectFactoryTest
Action class is: com.sun.proxy.$Proxy12
[INFO] Tests run: 23, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.400 s -- in com.opensymphony.xwork2.spring.SpringObjectFactoryTest
[INFO] Running com.opensymphony.xwork2.spring.ActionsFromSpringTest
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.094 s -- in com.opensymphony.xwork2.spring.ActionsFromSpringTest
[INFO] Running com.opensymphony.xwork2.spring.interceptor.ActionAutowiringInterceptorTest
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.091 s -- in com.opensymphony.xwork2.spring.interceptor.ActionAutowiringInterceptorTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 43, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-spring-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 34 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 33 licenses.
[INFO]
[INFO] --- jar:3.2.0:jar (default-jar) @ struts2-spring-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/struts2-spring-plugin-6.4.0-SNAPSHOT.jar>
[INFO]
[INFO] >>> source:3.2.1:jar (attach-sources) > generate-sources @ struts2-spring-plugin >>>
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce) @ struts2-spring-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce-maven-version) @ struts2-spring-plugin ---
[INFO]
[INFO] <<< source:3.2.1:jar (attach-sources) < generate-sources @ struts2-spring-plugin <<<
[INFO]
[INFO]
[INFO] --- source:3.2.1:jar (attach-sources) @ struts2-spring-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/struts2-spring-plugin-6.4.0-SNAPSHOT-sources.jar>
[INFO]
[INFO] --- site:3.12.1:attach-descriptor (attach-descriptor) @ struts2-spring-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:8.4.2:check (default) @ struts2-spring-plugin ---
[INFO] Checking for updates
[INFO] Skipping NVD check since last check was within 4 hours.
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Skipping Hosted Suppressions file update since last update was within 2 hours.
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (48 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Spring Plugin:
spring-web-5.3.31.jar (pkg:maven/org.springframework/spring-web@5.3.31, cpe:2.3:a:pivotal_software:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:web_project:web:5.3.31:*:*:*:*:*:*:*) : CVE-2024-22243
See the dependency-check report for more details.
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.4.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [04:51 min]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 2.758 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:03 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 2.748 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.153 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 7.488 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.275 s]
[INFO] Struts 2 Spring Plugin ............................. FAILURE [ 12.143 s]
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 DWR Plugin ................................ SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 07:31 min
[INFO] Finished at: 2024-03-22T06:46:49Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:8.4.2:check (default) on project struts2-spring-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-web-5.3.31.jar: CVE-2024-22243(8.1)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-spring-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #204
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/204/display/redirect?page=changes>
Changes:
[github] Bump maven-surefire-plugin.version from 3.0.0-M7 to 3.2.5
------------------------------------------
[...truncated 686.28 KB...]
[INFO]
[INFO] --- resources:3.1.0:resources (default-resources) @ struts2-spring-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 3 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- compiler:3.8.1:compile (default-compile) @ struts2-spring-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 9 source files to <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/classes>
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/com/opensymphony/xwork2/spring/SpringObjectFactory.java>: Some input files use or override a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/com/opensymphony/xwork2/spring/SpringObjectFactory.java>: Recompile with -Xlint:deprecation for details.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java>: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java> uses unchecked or unsafe operations.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/main/java/org/apache/struts2/spring/ClassReloadingInstantiationStrategy.java>: Recompile with -Xlint:unchecked for details.
[INFO]
[INFO] --- bundle:5.1.9:manifest (bundle-manifest) @ struts2-spring-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.1.0:testResources (default-testResources) @ struts2-spring-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 4 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- compiler:3.8.1:testCompile (default-testCompile) @ struts2-spring-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 17 source files to <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/test-classes>
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java>: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java> uses or overrides a deprecated API.
[INFO] <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessProxyTest.java>: Recompile with -Xlint:deprecation for details.
[INFO]
[INFO] --- surefire:3.2.5:test (default-test) @ struts2-spring-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.spring.StrutsSpringObjectFactoryTest
06:47:01.265 [main] FATAL org.apache.struts2.spring.StrutsSpringObjectFactory - ********** FATAL ERROR STARTING UP STRUTS-SPRING INTEGRATION **********
Looks like the Spring listener was not configured for your web app!
Nothing will work until WebApplicationContextUtils returns a valid ApplicationContext.
You might need to add the following to web.xml:
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.785 s -- in org.apache.struts2.spring.StrutsSpringObjectFactoryTest
[INFO] Running com.opensymphony.xwork2.ognl.SecurityMemberAccessProxyTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.766 s -- in com.opensymphony.xwork2.ognl.SecurityMemberAccessProxyTest
[INFO] Running com.opensymphony.xwork2.spring.ActionsFromSpringTest
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.777 s -- in com.opensymphony.xwork2.spring.ActionsFromSpringTest
[INFO] Running com.opensymphony.xwork2.spring.SpringObjectFactoryTest
Action class is: com.sun.proxy.$Proxy12
[INFO] Tests run: 23, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.166 s -- in com.opensymphony.xwork2.spring.SpringObjectFactoryTest
[INFO] Running com.opensymphony.xwork2.spring.SpringProxyUtilTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.520 s -- in com.opensymphony.xwork2.spring.SpringProxyUtilTest
[INFO] Running com.opensymphony.xwork2.spring.interceptor.ActionAutowiringInterceptorTest
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.070 s -- in com.opensymphony.xwork2.spring.interceptor.ActionAutowiringInterceptorTest
[INFO] Running com.test.SecurityMemberAccessProxyTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.250 s -- in com.test.SecurityMemberAccessProxyTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 43, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-spring-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 34 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 33 licenses.
[INFO]
[INFO] --- jar:3.2.0:jar (default-jar) @ struts2-spring-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/struts2-spring-plugin-6.4.0-SNAPSHOT.jar>
[INFO]
[INFO] >>> source:3.2.1:jar (attach-sources) > generate-sources @ struts2-spring-plugin >>>
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce) @ struts2-spring-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce-maven-version) @ struts2-spring-plugin ---
[INFO]
[INFO] <<< source:3.2.1:jar (attach-sources) < generate-sources @ struts2-spring-plugin <<<
[INFO]
[INFO]
[INFO] --- source:3.2.1:jar (attach-sources) @ struts2-spring-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/struts2-spring-plugin-6.4.0-SNAPSHOT-sources.jar>
[INFO]
[INFO] --- site:3.12.1:attach-descriptor (attach-descriptor) @ struts2-spring-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:8.4.2:check (default) @ struts2-spring-plugin ---
[INFO] Checking for updates
[INFO] Skipping NVD check since last check was within 4 hours.
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Skipping Hosted Suppressions file update since last update was within 2 hours.
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (29 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/spring/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Spring Plugin:
spring-web-5.3.31.jar (pkg:maven/org.springframework/spring-web@5.3.31, cpe:2.3:a:pivotal_software:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:5.3.31:*:*:*:*:*:*:*, cpe:2.3:a:web_project:web:5.3.31:*:*:*:*:*:*:*) : CVE-2024-22243
See the dependency-check report for more details.
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.4.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [04:47 min]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 3.379 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:24 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.032 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.534 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.507 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.252 s]
[INFO] Struts 2 Spring Plugin ............................. FAILURE [ 13.080 s]
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 DWR Plugin ................................ SKIPPED
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SKIPPED
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SKIPPED
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 07:52 min
[INFO] Finished at: 2024-03-01T06:47:12Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:8.4.2:check (default) on project struts2-spring-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-web-5.3.31.jar: CVE-2024-22243(8.1)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-spring-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #203
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/203/display/redirect?page=changes>
Changes:
[github] Bump net.sf.jasperreports:jasperreports from 6.20.6 to 6.21.0
[Sebastian.Peters] Update maven-war-plugin to 3.4.0
[Sebastian.Peters] Update maven-site-plugin to 3.12.1
[Sebastian.Peters] Update assertj to 3.25.2
[Sebastian.Peters] Update slf4j to 2.0.11
[Sebastian.Peters] Update jackson to 2.16.1
[Sebastian.Peters] Update spring to 5.3.31
[Sebastian.Peters] Update log4j2 to 2.21.1
[Sebastian.Peters] Update maven-dependency-plugin to 3.6.1
[Sebastian.Peters] Update maven-enforcer-plugin to 3.4.1
[Sebastian.Peters] Update commons-lang3 to 3.14.0
[Sebastian.Peters] Update commons-io to 2.15.1
[Sebastian.Peters] Update commons-text to 1.11.0
[git] WW-5391 Add interface for VelocityManager extension point
[git] WW-5391 Fix VelocityDecoratorServlet
[git] WW-5391 Migrate other usages
[git] WW-5391 Fix bean definition
[git] WW-5391 Fix serialisation warnings
[Aleksandr Mashchenko] WW-5394 Use request encoding
[github] Bump commons-logging:commons-logging from 1.2 to 1.3.0
[github] Bump actions/upload-artifact from 4.3.0 to 4.3.1
[Greg Huber] s:file shows server/file location WW-5396
[Greg Huber] s:file shows server/file location WW-5396
[Greg Huber] s:file shows server/file location WW-5396
[Greg Huber] s:file shows server/file location WW-5396
[github] Updates link to build status on Jenkins
[github] Bump org.apache.maven.doxia:doxia-core from 1.9.1 to 1.12.0
[github] Bump slf4j.version from 2.0.11 to 2.0.12
[github] Bump commons-validator:commons-validator from 1.6 to 1.8.0
[github] Bump org.apache.maven.doxia:doxia-module-markdown from 1.9.1 to 1.12.0
[github] Bump org.apache.commons:commons-compress from 1.25.0 to 1.26.0
------------------------------------------
[...truncated 1006.24 KB...]
[INFO] Running org.apache.tiles.request.collection.ScopeMapEntrySetTest
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.ScopeMapEntrySetTest
[INFO] Running org.apache.tiles.request.collection.CollectionUtilTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.CollectionUtilTest
[INFO] Running org.apache.tiles.request.collection.ReadOnlyEnumerationMapValuesCollectionTest
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.collection.ReadOnlyEnumerationMapValuesCollectionTest
[INFO] Running org.apache.tiles.request.collection.ReadOnlyEnumerationMapTest
[INFO] Tests run: 15, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.075 s - in org.apache.tiles.request.collection.ReadOnlyEnumerationMapTest
[INFO] Running org.apache.tiles.request.collection.HeaderValuesCollectionTest
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.collection.HeaderValuesCollectionTest
[INFO] Running org.apache.tiles.request.collection.AddableParameterMapTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.collection.AddableParameterMapTest
[INFO] Running org.apache.tiles.request.collection.MapEntryArrayValuesTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.MapEntryArrayValuesTest
[INFO] Running org.apache.tiles.request.collection.RemovableKeySetTest
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.collection.RemovableKeySetTest
[INFO] Running org.apache.tiles.request.collection.ScopeMapTest
[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.ScopeMapTest
[INFO] Running org.apache.tiles.request.collection.HeaderValuesMapEntrySetTest
[INFO] Tests run: 15, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.HeaderValuesMapEntrySetTest
[INFO] Running org.apache.tiles.request.collection.MapEntryTest
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.collection.MapEntryTest
[INFO] Running org.apache.tiles.request.render.ChainedDelegateRendererTest
[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.render.ChainedDelegateRendererTest
[INFO] Running org.apache.tiles.request.render.DispatchRendererTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.render.DispatchRendererTest
[INFO] Running org.apache.tiles.request.render.NoSuchRendererExceptionTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.render.NoSuchRendererExceptionTest
[INFO] Running org.apache.tiles.request.render.StringRendererTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.render.StringRendererTest
[INFO] Running org.apache.tiles.request.render.BasicRendererFactoryTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.render.BasicRendererFactoryTest
[INFO] Running org.apache.tiles.request.AbstractRequestTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.AbstractRequestTest
[INFO] Running org.apache.tiles.request.RequestExceptionTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.RequestExceptionTest
[INFO] Running org.apache.tiles.request.AbstractViewRequestTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.023 s - in org.apache.tiles.request.AbstractViewRequestTest
[INFO] Running org.apache.tiles.request.DispatchRequestWrapperTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.DispatchRequestWrapperTest
[INFO] Running org.apache.tiles.request.NotAvailableFeatureExceptionTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.NotAvailableFeatureExceptionTest
[INFO] Running org.apache.tiles.request.ApplicationAccessTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.ApplicationAccessTest
[INFO] Running org.apache.tiles.request.reflect.CannotInstantiateObjectExceptionTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.reflect.CannotInstantiateObjectExceptionTest
[INFO] Running org.apache.tiles.request.reflect.ClassUtilTest
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.reflect.ClassUtilTest
[INFO] Running org.apache.tiles.request.AbstractClientRequestTest
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.014 s - in org.apache.tiles.request.AbstractClientRequestTest
[INFO] Running org.apache.tiles.request.locale.URLApplicationResourceTest
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in org.apache.tiles.request.locale.URLApplicationResourceTest
[INFO] Running org.apache.tiles.request.locale.PostfixedApplicationResourceTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.locale.PostfixedApplicationResourceTest
[INFO] Running org.apache.tiles.request.locale.LocaleUtilTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in org.apache.tiles.request.locale.LocaleUtilTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 540, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.15:check (default) @ struts2-tiles-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 62 implicit excludes.
[INFO] 17 explicit excludes.
[INFO] 483 resources included
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 482 licenses.
[INFO]
[INFO] --- jar:3.2.0:jar (default-jar) @ struts2-tiles-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/tiles/target/struts2-tiles-plugin-6.4.0-SNAPSHOT.jar>
[INFO]
[INFO] >>> source:3.2.1:jar (attach-sources) > generate-sources @ struts2-tiles-plugin >>>
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce) @ struts2-tiles-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.4.1:enforce (enforce-maven-version) @ struts2-tiles-plugin ---
[INFO]
[INFO] <<< source:3.2.1:jar (attach-sources) < generate-sources @ struts2-tiles-plugin <<<
[INFO]
[INFO]
[INFO] --- source:3.2.1:jar (attach-sources) @ struts2-tiles-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/tiles/target/struts2-tiles-plugin-6.4.0-SNAPSHOT-sources.jar>
[INFO]
[INFO] --- site:3.12.1:attach-descriptor (attach-descriptor) @ struts2-tiles-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check:8.4.2:check (default) @ struts2-tiles-plugin ---
[INFO] Checking for updates
[INFO] Skipping NVD check since last check was within 4 hours.
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Skipping Hosted Suppressions file update since last update was within 2 hours.
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (47 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:groovy, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:log4j, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:jruby:jruby, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/net\.sf\.oval/oval@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:xstream_project:xstream, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$, regex=true, caseSensitive=false},cve={CVE-2022-40151,CVE-2022-40152,CVE-2022-40153,CVE-2022-40154,CVE-2022-40155,CVE-2022-40156,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/tiles/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Tiles Plugin:
javax.el-3.0.1-b12.jar (pkg:maven/org.glassfish/javax.el@3.0.1-b12) : CVE-2021-28170
See the dependency-check report for more details.
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[INFO] Cache event queue destroyed: {0}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[ERROR] {0}: Not alive and dispose was called, filename: {1}
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 6.4.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [03:18 min]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 3.158 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:15 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.221 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.607 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 7.869 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.401 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.704 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 8.850 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 8.532 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.642 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 14.013 s]
[INFO] Struts 2 DWR Plugin ................................ SUCCESS [ 3.353 s]
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin, since 6.0.0 SUCCESS [ 12.265 s]
[INFO] DEPRECATED: Struts 2 GXP Plugin - since 6.0.0 ...... SUCCESS [ 3.542 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 9.718 s]
[INFO] Struts 2 Java Templates Plugin ..................... SUCCESS [ 5.027 s]
[INFO] Struts 2 JFreeChart Plugin ......................... SUCCESS [ 5.869 s]
[INFO] Struts 2 JSON Plugin ............................... SUCCESS [ 9.778 s]
[INFO] DEPRECATED: Struts 2 OSGi Plugin - since 6.0.0 ..... SUCCESS [ 6.082 s]
[INFO] DEPRECATED: Struts 2 OVal Plugin, since 6.0.0 ...... SUCCESS [ 7.584 s]
[INFO] DEPRECATED: Struts 2 Pell Multipart Plugin - since 6.2.0 SUCCESS [ 2.500 s]
[INFO] DEPRECATED: Struts 2 Plexus Plugin - since 6.0.0 ... SUCCESS [ 3.182 s]
[INFO] DEPRECATED: Struts 2 Portlet Mocks Plugin - since 6.0.0 SUCCESS [ 5.414 s]
[INFO] DEPRECATED: Struts 2 Portlet Plugin - since 6.0.0 .. SUCCESS [ 9.300 s]
[INFO] DEPRECATED: Struts 2 Portlet JUnit Plugin - since 6.3.0 SUCCESS [ 5.997 s]
[INFO] Struts 2 Tiles Plugin .............................. FAILURE [ 12.520 s]
[INFO] DEPRECATED: Struts 2 Portlet Tiles Plugin - since 6.0.0 SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 Sitemesh Plugin ........................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Bundles - since 6.0.0 .... SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Admin Bundle - since 6.0.0 SKIPPED
[INFO] DEPRECATED: Struts 2 OSGi Demo Bundle - since 6.0.0 SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 08:29 min
[INFO] Finished at: 2024-02-22T10:00:22Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:8.4.2:check (default) on project struts2-tiles-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] javax.el-3.0.1-b12.jar: CVE-2021-28170(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-tiles-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3