Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependency org.apache.httpcomponents:httpclient, leading to CVE problem #2183

Open
CVEDetect opened this issue Nov 7, 2022 · 0 comments
Open

Dependency org.apache.httpcomponents:httpclient, leading to CVE problem #2183

CVEDetect opened this issue Nov 7, 2022 · 0 comments

Comments

@CVEDetect
Copy link

CVEDetect commented Nov 7, 2022 •
edited
Loading

Hi, In opencga-server/，there is a dependency **org.apache.httpcomponents:httpclient:4.5.6
** that calls the risk method.

CVE-2020-13956

The scope of this CVE affected version is [,4.5.13)

After further analysis, in this project, the main Api called is org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

org.opencb.opencga.server.rest.OpenCGAWSServer: run(java.util.concurrent.Callable)Ljavax.ws.rs.core.Response; .m2/repository/net/sourceforge/owlapi/owlapi-api/5.1.13/owlapi-api-5.1.13.jar
org.apache.http.impl.client.HttpRequestTaskCallable: call()Ljava.lang.Object; .m2/repository/net/sourceforge/owlapi/owlapi-api/5.1.13/owlapi-api-5.1.13.jar
org.apache.http.impl.client.CloseableHttpClient: execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.client.ResponseHandler,org.apache.http.protocol.HttpContext)Ljava.lang.Object; .m2/repository/net/sourceforge/owlapi/owlapi-api/5.1.13/owlapi-api-5.1.13.jar
org.apache.http.impl.client.CloseableHttpClient: determineTarget(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.HttpHost; .m2/repository/net/sourceforge/owlapi/owlapi-api/5.1.13/owlapi-api-5.1.13.jar
org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost;

Dependency tree--

[INFO] org.opencb.opencga:opencga-server:war:2.5.0-SNAPSHOT
[INFO] +- org.opencb.opencga:opencga-catalog:jar:2.5.0-SNAPSHOT:compile
[INFO] |  +- org.opencb.opencga:opencga-core:jar:2.5.0-SNAPSHOT:compile
[INFO] |  |  +- org.opencb.biodata:biodata-models:jar:2.5.0-SNAPSHOT:compile
[INFO] |  |  |  \- com.github.samtools:htsjdk:jar:2.23.0:compile
[INFO] |  |  |     +- org.apache.commons:commons-jexl:jar:2.1.1:compile
[INFO] |  |  |     +- org.tukaani:xz:jar:1.8:compile
[INFO] |  |  |     \- gov.nih.nlm.ncbi:ngs-java:jar:2.9.0:compile
[INFO] |  |  +- org.apache.commons:commons-collections4:jar:4.4:compile
[INFO] |  |  +- org.slf4j:slf4j-api:jar:1.7.32:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.17.2:compile
[INFO] |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.17.2:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-core:jar:2.17.2:compile
[INFO] |  |  +- javax.mail:mail:jar:1.4.7:compile
[INFO] |  |  |  \- javax.activation:activation:jar:1.1:compile
[INFO] |  |  \- org.passay:passay:jar:1.6.1:compile
[INFO] |  +- org.opencb.commons:commons-lib:jar:4.5.0-SNAPSHOT:compile
[INFO] |  |  +- com.beust:jcommander:jar:1.69:compile
[INFO] |  |  +- org.apache.avro:avro:jar:1.7.7:compile
[INFO] |  |  |  +- org.codehaus.jackson:jackson-core-asl:jar:1.9.13:compile
[INFO] |  |  |  +- org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13:compile
[INFO] |  |  |  +- com.thoughtworks.paranamer:paranamer:jar:2.3:compile
[INFO] |  |  |  \- org.apache.commons:commons-compress:jar:1.4.1:compile
[INFO] |  |  +- org.apache.commons:commons-lang3:jar:3.12.0:compile
[INFO] |  |  +- org.apache.ant:ant:jar:1.10.12:compile
[INFO] |  |  |  \- org.apache.ant:ant-launcher:jar:1.10.12:compile
[INFO] |  |  \- org.fusesource.jansi:jansi:jar:2.4.0:compile
[INFO] |  +- org.opencb.commons:commons-datastore-mongodb:jar:4.5.0-SNAPSHOT:compile
[INFO] |  |  \- org.mongodb:mongo-java-driver:jar:3.12.10:compile
[INFO] |  +- org.opencb.commons:commons-datastore-solr:jar:4.5.0-SNAPSHOT:compile
[INFO] |  +- io.jsonwebtoken:jjwt-api:jar:0.11.2:compile
[INFO] |  +- io.jsonwebtoken:jjwt-impl:jar:0.11.2:runtime
[INFO] |  +- io.jsonwebtoken:jjwt-jackson:jar:0.11.2:runtime
[INFO] |  +- org.apache.solr:solr-solrj:jar:8.8.2:compile
[INFO] |  |  +- commons-io:commons-io:jar:2.8.0:compile
[INFO] |  |  +- commons-lang:commons-lang:jar:2.6:compile
[INFO] |  |  +- io.netty:netty-buffer:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-codec:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-common:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-handler:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-resolver:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-transport:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-transport-native-epoll:jar:4.1.50.Final:compile
[INFO] |  |  +- io.netty:netty-transport-native-unix-common:jar:4.1.50.Final:compile
[INFO] |  |  +- org.apache.commons:commons-math3:jar:3.6.1:compile
[INFO] |  |  +- org.apache.httpcomponents:httpcore:jar:4.4.13:compile
[INFO] |  |  +- org.apache.httpcomponents:httpmime:jar:4.5.12:compile
[INFO] |  |  +- org.apache.zookeeper:zookeeper:jar:3.6.2:compile
[INFO] |  |  +- org.apache.zookeeper:zookeeper-jute:jar:3.6.2:compile
[INFO] |  |  +- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
[INFO] |  |  +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-client:jar:9.4.17.v20190418:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-alpn-java-client:jar:9.4.17.v20190418:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-client:jar:9.4.17.v20190418:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-util:jar:9.4.17.v20190418:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-client:jar:9.4.34.v20201102:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-common:jar:9.4.34.v20201102:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-hpack:jar:9.4.34.v20201102:compile
[INFO] |  |  +- org.eclipse.jetty.http2:http2-http-client-transport:jar:9.4.34.v20201102:compile
[INFO] |  |  +- org.slf4j:jcl-over-slf4j:jar:1.7.24:compile
[INFO] |  |  \- org.xerial.snappy:snappy-java:jar:1.1.7.6:compile
[INFO] |  +- io.fabric8:kubernetes-client:jar:4.3.0:compile
[INFO] |  |  +- io.fabric8:kubernetes-model:jar:4.3.0:compile
[INFO] |  |  |  +- io.fabric8:kubernetes-model-common:jar:4.3.0:compile
[INFO] |  |  |  +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] |  |  |  +- org.glassfish:javax.el:jar:3.0.1-b11:compile
[INFO] |  |  |  +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  |  |  \- javax.xml.bind:jaxb-api:jar:2.3.0:compile
[INFO] |  |  +- com.squareup.okhttp3:okhttp:jar:3.12.0:compile
[INFO] |  |  +- com.squareup.okhttp3:logging-interceptor:jar:3.12.0:compile
[INFO] |  |  +- org.slf4j:jul-to-slf4j:jar:1.7.26:compile
[INFO] |  |  +- io.fabric8:zjsonpatch:jar:0.3.0:compile
[INFO] |  |  \- com.github.mifmif:generex:jar:1.0.2:compile
[INFO] |  |     \- dk.brics.automaton:automaton:jar:1.11-8:compile
[INFO] |  +- com.microsoft.azure:adal4j:jar:1.6.3:compile
[INFO] |  |  +- com.nimbusds:oauth2-oidc-sdk:jar:5.64.4:compile
[INFO] |  |  |  +- com.sun.mail:javax.mail:jar:1.6.1:compile
[INFO] |  |  |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  |  |  +- net.minidev:json-smart:jar:2.3:compile (version selected from constraint [1.3.1,2.3])
[INFO] |  |  |  |  \- net.minidev:accessors-smart:jar:1.2:compile
[INFO] |  |  |  |     \- org.ow2.asm:asm:jar:5.0.4:compile
[INFO] |  |  |  +- com.nimbusds:lang-tag:jar:1.7:compile (version selected from constraint [1.4.3,))
[INFO] |  |  |  \- com.nimbusds:nimbus-jose-jwt:jar:9.25.6:compile (version selected from constraint [5.5,))
[INFO] |  |  +- com.google.code.gson:gson:jar:2.8.0:compile
[INFO] |  |  \- commons-codec:commons-codec:jar:1.11:compile
[INFO] |  +- com.microsoft.graph:microsoft-graph:jar:1.4.0:compile
[INFO] |  |  \- com.google.guava:guava:jar:19.0:compile
[INFO] |  +- com.microsoft.azure:azure:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-client-authentication:jar:1.5.4:compile
[INFO] |  |  |  \- com.microsoft.azure:azure-annotations:jar:1.2.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-resources:jar:1.13.0:compile
[INFO] |  |  |  \- io.reactivex:rxjava:jar:1.2.4:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-storage:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-network:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-compute:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-graph-rbac:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-keyvault:jar:1.13.0:compile
[INFO] |  |  |  \- com.microsoft.azure:azure-keyvault:jar:1.0.0:compile
[INFO] |  |  |     \- com.microsoft.azure:azure-keyvault-webkey:jar:1.0.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-batch:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-trafficmanager:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-dns:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-redis:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-appservice:jar:1.13.0:compile
[INFO] |  |  |  \- com.microsoft.azure:azure-storage:jar:6.1.0:compile
[INFO] |  |  |     \- com.microsoft.azure:azure-keyvault-core:jar:0.8.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-locks:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-eventhub:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-cdn:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-sql:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-containerinstance:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-containerregistry:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-containerservice:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-cosmosdb:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-search:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-msi:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-monitor:jar:1.13.0:compile
[INFO] |  |  +- com.microsoft.azure:azure-mgmt-servicebus:jar:1.13.0:compile
[INFO] |  |  |  \- joda-time:joda-time:jar:2.1:compile
[INFO] |  |  \- com.microsoft.azure:azure-mgmt-batchai:jar:1.13.0:compile
[INFO] |  +- com.microsoft.azure:azure-batch:jar:4.0.1:compile
[INFO] |  \- com.microsoft.azure:azure-client-runtime:jar:1.6.4:compile
[INFO] |     \- com.microsoft.rest:client-runtime:jar:1.6.4:compile
[INFO] |        +- com.squareup.retrofit2:retrofit:jar:2.4.0:compile
[INFO] |        +- com.squareup.okhttp3:okhttp-urlconnection:jar:3.11.0:compile
[INFO] |        +- com.squareup.retrofit2:converter-jackson:jar:2.4.0:compile
[INFO] |        +- com.fasterxml.jackson.datatype:jackson-datatype-joda:jar:2.11.4:compile
[INFO] |        \- com.squareup.retrofit2:adapter-rxjava:jar:2.4.0:compile
[INFO] +- org.opencb.opencga:opencga-storage-core:jar:2.5.0-SNAPSHOT:compile
[INFO] |  +- org.opencb.cellbase:cellbase-client:jar:5.3.0-SNAPSHOT:compile
[INFO] |  |  +- org.opencb.cellbase:cellbase-core:jar:5.3.0-SNAPSHOT:compile
[INFO] |  |  \- org.glassfish.jersey.core:jersey-client:jar:2.30.1:compile
[INFO] |  +- org.redisson:redisson:jar:2.2.0:compile
[INFO] |  |  +- io.projectreactor:reactor-stream:jar:2.0.7.RELEASE:compile
[INFO] |  |  |  \- io.projectreactor:reactor-core:jar:2.0.7.RELEASE:compile
[INFO] |  |  |     \- org.reactivestreams:reactive-streams:jar:1.0.0:compile
[INFO] |  |  \- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar:2.11.4:compile
[INFO] |  +- com.esotericsoftware.kryo:kryo:jar:2.23.0:compile
[INFO] |  |  +- com.esotericsoftware.minlog:minlog:jar:1.2:compile
[INFO] |  |  \- org.objenesis:objenesis:jar:2.1:compile
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.6:compile
[INFO] |  |  \- commons-logging:commons-logging:jar:1.2:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.11.4:compile
[INFO] |  \- org.opencb.oskar:oskar-analysis:jar:0.2.0:compile
[INFO] |     +- org.opencb.oskar:oskar-core:jar:0.2.0:compile
[INFO] |     +- org.opencb.biodata:biodata-tools:jar:2.5.0-SNAPSHOT:compile
[INFO] |     |  +- org.opencb.biodata:biodata-formats:jar:2.5.0-SNAPSHOT:compile
[INFO] |     |  |  +- com.sun.xml.bind:jaxb-impl:jar:2.3.3:runtime
[INFO] |     |  |  \- net.sourceforge.owlapi:owlapi-oboformat:jar:5.1.13:compile
[INFO] |     |  |     +- net.sourceforge.owlapi:owlapi-parsers:jar:5.1.13:compile
[INFO] |     |  |     |  \- net.sourceforge.owlapi:owlapi-api:jar:5.1.13:compile
[INFO] |     |  |     |     +- org.apache.commons:commons-rdf-api:jar:0.5.0:compile
[INFO] |     |  |     |     \- javax.inject:javax.inject:jar:1:compile
[INFO] |     |  |     +- com.github.vsonnier:hppcrt:jar:0.7.5:compile
[INFO] |     |  |     \- com.github.ben-manes.caffeine:caffeine:jar:2.6.1:compile
[INFO] |     |  +- org.opencb.ga4gh:ga4gh:jar:0.6.0a5:compile
[INFO] |     |  +- log4j:log4j:jar:1.2.17:compile
[INFO] |     |  +- com.databricks:SnpEff:jar:4.3.1:compile
[INFO] |     |  |  +- org.apfloat:apfloat:jar:1.6.3:compile
[INFO] |     |  |  +- com.googlecode.charts4j:charts4j:jar:1.3:compile
[INFO] |     |  |  +- commons-cli:commons-cli:jar:1.2:compile
[INFO] |     |  |  +- net.sf.trove4j:trove4j:jar:3.0.2:compile
[INFO] |     |  |  +- org.freemarker:freemarker:jar:2.3.19:compile
[INFO] |     |  |  +- distlib:distlib:jar:0.9.1:compile
[INFO] |     |  |  +- org.biojava:biojava-core:jar:5.0.0:compile
[INFO] |     |  |  \- org.biojava:biojava-structure:jar:5.0.0:compile
[INFO] |     |  |     +- org.rcsb:mmtf-api:jar:1.0.7:compile
[INFO] |     |  |     +- org.rcsb:mmtf-serialization:jar:1.0.7:compile
[INFO] |     |  |     |  \- org.msgpack:jackson-dataformat-msgpack:jar:0.7.1:compile
[INFO] |     |  |     |     \- org.msgpack:msgpack-core:jar:0.7.1:compile
[INFO] |     |  |     +- org.rcsb:mmtf-codec:jar:1.0.7:compile
[INFO] |     |  |     +- java3d:vecmath:jar:1.3.1:compile
[INFO] |     |  |     \- org.jgrapht:jgrapht-core:jar:1.1.0:compile
[INFO] |     |  +- org.rocksdb:rocksdbjni:jar:4.5.1:compile
[INFO] |     |  \- org.biojava:biojava-alignment:jar:4.1.0:compile
[INFO] |     |     +- org.biojava:biojava-phylo:jar:4.1.0:compile
[INFO] |     |     \- org.biojava.thirdparty:forester:jar:1.005:compile
[INFO] |     \- org.reflections:reflections:jar:0.9.10:compile
[INFO] |        \- com.google.code.findbugs:annotations:jar:2.0.1:compile
[INFO] +- org.opencb.opencga:opencga-analysis:jar:2.5.0-SNAPSHOT:compile
[INFO] |  +- org.opencb.commons:commons-datastore-core:jar:4.5.0-SNAPSHOT:compile
[INFO] |  \- org.opencb.opencga:opencga-clinical:jar:2.5.0-SNAPSHOT:compile
[INFO] +- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.30.1:compile
[INFO] |  +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.30.1:compile
[INFO] |  |  \- org.glassfish.hk2.external:jakarta.inject:jar:2.6.1:compile
[INFO] |  +- org.glassfish.jersey.core:jersey-common:jar:2.30.1:compile
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
[INFO] |  |  +- org.glassfish.hk2:osgi-resource-locator:jar:1.0.3:compile
[INFO] |  |  \- com.sun.activation:jakarta.activation:jar:1.2.1:compile
[INFO] |  +- org.glassfish.jersey.core:jersey-server:jar:2.30.1:compile
[INFO] |  |  +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.30.1:compile
[INFO] |  |  +- jakarta.validation:jakarta.validation-api:jar:2.0.2:compile
[INFO] |  |  \- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
[INFO] |  \- jakarta.ws.rs:jakarta.ws.rs-api:jar:2.1.6:compile
[INFO] +- org.glassfish.jersey.media:jersey-media-multipart:jar:2.30.1:compile
[INFO] |  \- org.jvnet.mimepull:mimepull:jar:1.9.11:compile
[INFO] +- org.glassfish.jersey.media:jersey-media-json-jackson:jar:2.30.1:compile
[INFO] |  +- org.glassfish.jersey.ext:jersey-entity-filtering:jar:2.30.1:compile
[INFO] |  \- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.10.1:compile
[INFO] |     \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
[INFO] +- org.glassfish.jersey.inject:jersey-hk2:jar:2.30.1:compile
[INFO] |  +- org.glassfish.hk2:hk2-locator:jar:2.6.1:compile
[INFO] |  |  +- org.glassfish.hk2.external:aopalliance-repackaged:jar:2.6.1:compile
[INFO] |  |  +- org.glassfish.hk2:hk2-api:jar:2.6.1:compile
[INFO] |  |  \- org.glassfish.hk2:hk2-utils:jar:2.6.1:compile
[INFO] |  \- org.javassist:javassist:jar:3.25.0-GA:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.11.4:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-core:jar:2.11.4:compile
[INFO] +- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.11.4:compile
[INFO] |  \- org.yaml:snakeyaml:jar:1.26:compile
[INFO] +- org.opencb.opencga:opencga-catalog:test-jar:tests:2.5.0-SNAPSHOT:test
[INFO] +- com.google.protobuf:protobuf-java:jar:3.11.4:compile
[INFO] +- io.grpc:grpc-all:jar:1.28.1:compile
[INFO] |  +- io.grpc:grpc-api:jar:1.28.1:compile (version selected from constraint [1.28.1,1.28.1])
[INFO] |  |  +- com.google.errorprone:error_prone_annotations:jar:2.3.4:compile
[INFO] |  |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] |  |  \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.18:compile
[INFO] |  +- io.grpc:grpc-auth:jar:1.28.1:compile
[INFO] |  |  \- com.google.auth:google-auth-library-credentials:jar:0.20.0:compile
[INFO] |  +- io.grpc:grpc-core:jar:1.28.1:compile (version selected from constraint [1.28.1,1.28.1])
[INFO] |  |  +- com.google.android:annotations:jar:4.1.1.4:compile
[INFO] |  |  \- io.perfmark:perfmark-api:jar:0.19.0:compile
[INFO] |  +- io.grpc:grpc-context:jar:1.28.1:compile
[INFO] |  +- io.grpc:grpc-netty:jar:1.28.1:compile
[INFO] |  |  +- io.netty:netty-codec-http2:jar:4.1.45.Final:compile (version selected from constraint [4.1.45.Final,4.1.45.Final])
[INFO] |  |  |  \- io.netty:netty-codec-http:jar:4.1.45.Final:compile
[INFO] |  |  \- io.netty:netty-handler-proxy:jar:4.1.45.Final:compile
[INFO] |  |     \- io.netty:netty-codec-socks:jar:4.1.45.Final:compile
[INFO] |  +- io.grpc:grpc-okhttp:jar:1.28.1:compile
[INFO] |  |  +- com.squareup.okio:okio:jar:1.13.0:compile
[INFO] |  |  \- com.squareup.okhttp:okhttp:jar:2.7.4:compile
[INFO] |  +- io.grpc:grpc-protobuf:jar:1.28.1:compile
[INFO] |  |  +- com.google.api.grpc:proto-google-common-protos:jar:1.17.0:compile
[INFO] |  |  \- io.grpc:grpc-protobuf-lite:jar:1.28.1:compile
[INFO] |  +- io.grpc:grpc-stub:jar:1.28.1:compile
[INFO] |  \- io.grpc:grpc-testing:jar:1.28.1:compile
[INFO] |     \- io.opencensus:opencensus-api:jar:0.24.0:compile
[INFO] +- org.eclipse.jetty:jetty-server:jar:9.4.17.v20190418:compile
[INFO] |  +- javax.servlet:javax.servlet-api:jar:3.1.0:compile
[INFO] |  +- org.eclipse.jetty:jetty-http:jar:9.4.17.v20190418:compile
[INFO] |  \- org.eclipse.jetty:jetty-io:jar:9.4.17.v20190418:compile
[INFO] +- org.eclipse.jetty:jetty-webapp:jar:9.4.17.v20190418:compile
[INFO] |  +- org.eclipse.jetty:jetty-xml:jar:9.4.17.v20190418:compile
[INFO] |  \- org.eclipse.jetty:jetty-servlet:jar:9.4.17.v20190418:compile
[INFO] |     \- org.eclipse.jetty:jetty-security:jar:9.4.17.v20190418:compile
[INFO] +- junit:junit:jar:4.13.2:test
[INFO] |  \- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO] \- org.opencb.opencga:opencga-storage-mongodb:jar:2.5.0-SNAPSHOT:compile

Suggested solutions:

Update dependency version

Thank you very much.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@CVEDetect