search

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
23.67k stars 2.33k forks source link

Trivy does not recognize changed files in the image and still has old files in the report. #3552

Closed StevDa86 closed 1 year ago

StevDa86 commented 1 year ago

Description

Trivy does not recognize changed files in the image and still has old files in the report.

What did you expect to happen?

Trivy should detect that the files in the image have changed and adjust its report result.

What happened instead?

Trivy does not recognize the new files and continues to write the old version as unsafe in the report

Additional details (base image name, container registry info...):

Tested with trivy v0.37.1

Trivy Report shows this: trivy report

But in the scanned image the new JAR file exists. Pod data dir

AndreyLevchenko commented 1 year ago

Hi Thank you for your interest in Trivy Could you send entire command line? Also can you create json output generated with --list-all-pkgs option?

Thanks, Andrey

StevDa86 commented 1 year ago

i cleared the cache with the "image --reset" parameter before# this was my command to check the image.

docker run -i --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.37.2 image --debug --list-all-pkgs --cache-dir /home/jenkins/tmp imagename:tag

`2023-02-14T12:34:29.943Z INFO Analyzing JAR files takes a while... 2023-02-14T12:34:29.943Z DEBUG Parsing Java artifacts... {"file": "app/lib/HdrHistogram-2.1.12.jar"} 2023-02-14T12:34:29.943Z DEBUG Parsing Java artifacts... {"file": "app/lib/HikariCP-4.0.3.jar"} 2023-02-14T12:34:29.943Z DEBUG Parsing Java artifacts... {"file": "app/lib/LatencyUtils-2.0.3.jar"} 2023-02-14T12:34:29.943Z DEBUG Parsing Java artifacts... {"file": "app/lib/accessors-smart-2.4.8.jar"} 2023-02-14T12:34:29.944Z DEBUG Parsing Java artifacts... {"file": "app/lib/annotations-17.0.0.jar"} 2023-02-14T12:34:29.944Z DEBUG Parsing Java artifacts... {"file": "workdir/dd-java-agent.jar"} 2023-02-14T12:34:29.944Z DEBUG Parsing Java artifacts... {"file": "usr/lib/jvm/zulu17-ca/lib/jrt-fs.jar"} 2023-02-14T12:34:29.944Z DEBUG Parsing Java artifacts... {"file": "app/lib/annotations-3.0.1.jar"} 2023-02-14T12:34:29.946Z DEBUG No such POM in the central repositories {"file": "jrt-fs.jar"} 2023-02-14T12:34:29.968Z DEBUG Parsing Java artifacts... {"file": "app/lib/antlr-2.7.7.jar"} 2023-02-14T12:34:29.968Z DEBUG Parsing Java artifacts... {"file": "app/lib/aopalliance-1.0.jar"} 2023-02-14T12:34:29.969Z DEBUG No such POM in the central repositories {"file": "antlr-2.7.7.jar"} 2023-02-14T12:34:29.979Z DEBUG Parsing Java artifacts... {"file": "app/lib/asm-9.1.jar"} 2023-02-14T12:34:30.078Z DEBUG Parsing Java artifacts... {"file": "app/lib/aspectjweaver-1.9.7.jar"} 2023-02-14T12:34:30.078Z DEBUG Parsing Java artifacts... {"file": "app/lib/auth-core-backend-4.3.0.0.jar"} 2023-02-14T12:34:30.082Z DEBUG Parsing Java artifacts... {"file": "app/lib/automaton-1.11-8.jar"} 2023-02-14T12:34:30.083Z DEBUG No such POM in the central repositories {"file": "automaton-1.11-8.jar"} 2023-02-14T12:34:30.102Z DEBUG Parsing Java artifacts... {"file": "app/lib/azure-core-1.29.1.jar"} 2023-02-14T12:34:30.108Z DEBUG Parsing Java artifacts... {"file": "app/lib/azure-core-amqp-2.5.2.jar"} 2023-02-14T12:34:30.110Z DEBUG Parsing Java artifacts... {"file": "app/lib/azure-core-http-netty-1.12.2.jar"} 2023-02-14T12:34:30.111Z DEBUG Parsing Java artifacts... {"file": "app/lib/azure-core-management-1.6.2.jar"} 2023-02-14T12:34:30.116Z DEBUG Parsing Java artifacts... {"file": "app/lib/azure-identity-1.5.2.jar"} 2023-02-14T12:34:30.129Z DEBUG Parsing Java artifacts... {"file": "app/lib/bcpkix-jdk15on-1.56.jar"} 2023-02-14T12:34:30.203Z DEBUG Parsing Java artifacts... {"file": "app/lib/bcprov-jdk15on-1.56.jar"} 2023-02-14T12:34:30.210Z DEBUG Parsing Java artifacts... {"file": "app/lib/bsh-2.0b6.jar"} 2023-02-14T12:34:30.219Z DEBUG Parsing Java artifacts... {"file": "app/lib/bson-record-codec-4.6.1.jar"} 2023-02-14T12:34:30.219Z DEBUG Parsing Java artifacts... {"file": "app/lib/bson-4.6.1.jar"} 2023-02-14T12:34:30.220Z DEBUG Parsing Java artifacts... {"file": "app/lib/btf-1.3.jar"} 2023-02-14T12:34:30.221Z DEBUG Parsing Java artifacts... {"file": "app/lib/build-helper-maven-plugin-3.3.0.jar"} 2023-02-14T12:34:30.301Z DEBUG Parsing Java artifacts... {"file": "app/lib/byte-buddy-1.12.19.jar"} 2023-02-14T12:34:30.316Z DEBUG Parsing Java artifacts... {"file": "app/lib/caffeine-2.9.3.jar"} 2023-02-14T12:34:30.320Z DEBUG Parsing Java artifacts... {"file": "app/lib/checker-qual-3.19.0.jar"} 2023-02-14T12:34:30.331Z DEBUG Parsing Java artifacts... {"file": "app/lib/classgraph-4.8.147.jar"} 2023-02-14T12:34:30.332Z DEBUG Parsing Java artifacts... {"file": "app/lib/classmate-1.5.1.jar"} 2023-02-14T12:34:30.336Z DEBUG Parsing Java artifacts... {"file": "app/lib/commonmark-0.11.0.jar"} 2023-02-14T12:34:30.336Z DEBUG Parsing Java artifacts... {"file": "app/lib/commons-cli-1.4.jar"} 2023-02-14T12:34:30.343Z DEBUG Parsing Java artifacts... {"file": "app/lib/commons-codec-1.15.jar"} 2023-02-14T12:34:30.348Z DEBUG Parsing Java artifacts... {"file": "app/lib/commons-io-2.11.0.jar"} 2023-02-14T12:34:30.360Z DEBUG Parsing Java artifacts... {"file": "app/lib/commons-lang3-3.12.0.jar"} 2023-02-14T12:34:30.364Z DEBUG Parsing Java artifacts... {"file": "app/lib/commons-text-1.10.0.jar"} 2023-02-14T12:34:30.365Z DEBUG Parsing Java artifacts... {"file": "app/lib/error_prone_annotations-2.10.0.jar"} 2023-02-14T12:34:30.365Z DEBUG Parsing Java artifacts... {"file": "app/lib/content-type-2.2.jar"} 2023-02-14T12:34:30.365Z DEBUG Parsing Java artifacts... {"file": "app/lib/evo-inflector-1.3.jar"} 2023-02-14T12:34:30.366Z DEBUG Parsing Java artifacts... {"file": "app/lib/failureaccess-1.0.1.jar"} 2023-02-14T12:34:30.366Z DEBUG Parsing Java artifacts... {"file": "app/lib/file-management-3.0.0.jar"} 2023-02-14T12:34:30.366Z DEBUG Parsing Java artifacts... {"file": "app/lib/generex-1.0.2.jar"} 2023-02-14T12:34:30.373Z DEBUG Parsing Java artifacts... {"file": "app/lib/gson-2.9.1.jar"} 2023-02-14T12:34:30.436Z DEBUG Parsing Java artifacts... {"file": "app/lib/guava-30.1.1-jre.jar"} 2023-02-14T12:34:30.445Z DEBUG Parsing Java artifacts... {"file": "app/lib/guice-4.2.2-no_aop.jar"} 2023-02-14T12:34:30.447Z DEBUG No such POM in the central repositories {"file": "guice-4.2.2-no_aop.jar"} 2023-02-14T12:34:30.464Z DEBUG Parsing Java artifacts... {"file": "app/lib/handlebars-jackson2-4.2.1.jar"} 2023-02-14T12:34:30.465Z DEBUG Parsing Java artifacts... {"file": "app/lib/handlebars-4.2.1.jar"} 2023-02-14T12:34:30.467Z DEBUG Parsing Java artifacts... {"file": "app/lib/hibernate-commons-annotations-5.1.2.Final.jar"} 2023-02-14T12:34:30.646Z DEBUG Parsing Java artifacts... {"file": "app/lib/hibernate-core-5.6.5.Final.jar"} 2023-02-14T12:34:30.678Z DEBUG Parsing Java artifacts... {"file": "app/lib/hibernate-validator-6.2.5.Final.jar"} 2023-02-14T12:34:30.714Z DEBUG Parsing Java artifacts... {"file": "app/lib/hsqldb-2.5.2.jar"} 2023-02-14T12:34:30.728Z DEBUG Parsing Java artifacts... {"file": "app/lib/httpclient-4.5.13.jar"} 2023-02-14T12:34:30.735Z DEBUG Parsing Java artifacts... {"file": "app/lib/httpcore-4.4.15.jar"} 2023-02-14T12:34:30.736Z DEBUG Parsing Java artifacts... {"file": "app/lib/istack-commons-runtime-3.0.12.jar"} 2023-02-14T12:34:30.736Z DEBUG Parsing Java artifacts... {"file": "app/lib/j2objc-annotations-1.3.jar"} 2023-02-14T12:34:30.738Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-annotations-2.13.4.jar"} 2023-02-14T12:34:30.745Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-core-2.13.4.jar"} 2023-02-14T12:34:30.746Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-coreutils-2.0.jar"} 2023-02-14T12:34:30.746Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-coreutils-equivalence-1.0.jar"} 2023-02-14T12:34:30.779Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-databind-2.13.4.2.jar"} 2023-02-14T12:34:30.780Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-databind-nullable-0.2.2.jar"} 2023-02-14T12:34:30.784Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-dataformat-yaml-2.13.4.jar"} 2023-02-14T12:34:30.784Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-dataformat-xml-2.13.4.jar"} 2023-02-14T12:34:30.787Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-datatype-guava-2.13.4.jar"} 2023-02-14T12:34:30.788Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-datatype-jdk8-2.13.4.jar"} 2023-02-14T12:34:30.791Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-datatype-joda-2.13.4.jar"} 2023-02-14T12:34:30.793Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-datatype-jsr310-2.13.4.jar"} 2023-02-14T12:34:30.795Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-datatype-threetenbp-2.10.0.jar"} 2023-02-14T12:34:30.795Z DEBUG Parsing Java artifacts... {"file": "app/lib/jackson-module-parameter-names-2.13.4.jar"} 2023-02-14T12:34:30.797Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.activation-1.2.2.jar"} 2023-02-14T12:34:30.799Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.annotation-api-1.3.5.jar"} 2023-02-14T12:34:30.799Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.activation-api-1.2.2.jar"} 2023-02-14T12:34:30.812Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.mail-1.6.7.jar"} 2023-02-14T12:34:30.815Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.persistence-api-2.2.3.jar"} 2023-02-14T12:34:30.816Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.transaction-api-1.3.3.jar"} 2023-02-14T12:34:30.818Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.validation-api-2.0.2.jar"} 2023-02-14T12:34:30.819Z DEBUG Parsing Java artifacts... {"file": "app/lib/jakarta.xml.bind-api-2.3.3.jar"} 2023-02-14T12:34:30.823Z DEBUG Parsing Java artifacts... {"file": "app/lib/jandex-2.4.2.Final.jar"} 2023-02-14T12:34:30.837Z DEBUG Parsing Java artifacts... {"file": "app/lib/javassist-3.18.2-GA.jar"} 2023-02-14T12:34:30.840Z DEBUG Parsing Java artifacts... {"file": "app/lib/javax.annotation-api-1.3.2.jar"} 2023-02-14T12:34:30.840Z DEBUG Parsing Java artifacts... {"file": "app/lib/javax.batch-api-1.0.jar"} 2023-02-14T12:34:30.841Z DEBUG Parsing Java artifacts... {"file": "app/lib/javax.inject-1.jar"} 2023-02-14T12:34:30.841Z DEBUG Parsing Java artifacts... {"file": "app/lib/javax.activation-api-1.2.0.jar"} 2023-02-14T12:34:30.846Z DEBUG Parsing Java artifacts... {"file": "app/lib/javax.persistence-api-2.2.jar"} 2023-02-14T12:34:30.849Z DEBUG Parsing Java artifacts... {"file": "app/lib/jaxb-api-2.3.1.jar"} 2023-02-14T12:34:30.853Z DEBUG Parsing Java artifacts... {"file": "app/lib/jaxb-core-2.3.0.1.jar"} 2023-02-14T12:34:30.875Z DEBUG Parsing Java artifacts... {"file": "app/lib/jaxb-impl-2.3.1.jar"} 2023-02-14T12:34:30.895Z DEBUG Parsing Java artifacts... {"file": "app/lib/jaxb-runtime-2.3.7.jar"} 2023-02-14T12:34:30.896Z DEBUG Parsing Java artifacts... {"file": "app/lib/jboss-logging-3.4.3.Final.jar"} 2023-02-14T12:34:30.897Z DEBUG Parsing Java artifacts... {"file": "app/lib/jboss-transaction-api_1.2_spec-1.1.1.Final.jar"} 2023-02-14T12:34:30.897Z DEBUG Parsing Java artifacts... {"file": "app/lib/jcip-annotations-1.0-1.jar"} 2023-02-14T12:34:30.897Z DEBUG Parsing Java artifacts... {"file": "app/lib/jcip-annotations-1.0.jar"} 2023-02-14T12:34:30.898Z DEBUG No such POM in the central repositories {"file": "jcip-annotations-1.0.jar"} 2023-02-14T12:34:30.899Z DEBUG Parsing Java artifacts... {"file": "app/lib/jjwt-api-0.11.5.jar"} 2023-02-14T12:34:30.901Z DEBUG Parsing Java artifacts... {"file": "app/lib/jmustache-1.15.jar"} 2023-02-14T12:34:30.928Z DEBUG Parsing Java artifacts... {"file": "app/lib/jna-5.5.0.jar"} 2023-02-14T12:34:30.969Z DEBUG Parsing Java artifacts... {"file": "app/lib/jna-platform-5.6.0.jar"} 2023-02-14T12:34:30.985Z DEBUG Parsing Java artifacts... {"file": "app/lib/joda-time-2.10.8.jar"} 2023-02-14T12:34:30.988Z DEBUG Parsing Java artifacts... {"file": "app/lib/jopt-simple-5.0.4.jar"} 2023-02-14T12:34:30.989Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-20220320.jar"} 2023-02-14T12:34:30.990Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-patch-1.13.jar"} 2023-02-14T12:34:30.996Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-path-2.7.0.jar"} 2023-02-14T12:34:31.000Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-schema-core-1.2.14.jar"} 2023-02-14T12:34:31.005Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-schema-validator-2.2.14.jar"} 2023-02-14T12:34:31.008Z DEBUG Parsing Java artifacts... {"file": "app/lib/json-smart-2.4.8.jar"} 2023-02-14T12:34:31.009Z DEBUG Parsing Java artifacts... {"file": "app/lib/jsr305-3.0.2.jar"} 2023-02-14T12:34:31.009Z DEBUG Parsing Java artifacts... {"file": "app/lib/jul-to-slf4j-1.7.36.jar"} 2023-02-14T12:34:31.117Z DEBUG Parsing Java artifacts... {"file": "app/lib/kafka-clients-3.1.2.jar"} 2023-02-14T12:34:31.156Z DEBUG Parsing Java artifacts... {"file": "app/lib/kotlin-stdlib-1.6.21.jar"} 2023-02-14T12:34:31.164Z DEBUG Parsing Java artifacts... {"file": "app/lib/kotlin-stdlib-common-1.6.21.jar"} 2023-02-14T12:34:31.165Z DEBUG Parsing Java artifacts... {"file": "app/lib/kotlin-stdlib-jdk7-1.6.21.jar"} 2023-02-14T12:34:31.166Z DEBUG Parsing Java artifacts... {"file": "app/lib/kotlin-stdlib-jdk8-1.6.21.jar"} 2023-02-14T12:34:31.183Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-client-5.10.2.jar"} 2023-02-14T12:34:31.197Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-admissionregistration-5.10.2.jar"} 2023-02-14T12:34:31.209Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-apiextensions-5.10.2.jar"} 2023-02-14T12:34:31.218Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-apps-5.10.2.jar"} 2023-02-14T12:34:31.230Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-autoscaling-5.10.2.jar"} 2023-02-14T12:34:31.236Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-batch-5.10.2.jar"} 2023-02-14T12:34:31.239Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-certificates-5.10.2.jar"} 2023-02-14T12:34:31.240Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-common-5.10.2.jar"} 2023-02-14T12:34:31.241Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-coordination-5.10.2.jar"} 2023-02-14T12:34:31.323Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-core-5.10.2.jar"} 2023-02-14T12:34:31.329Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-discovery-5.10.2.jar"} 2023-02-14T12:34:31.332Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-events-5.10.2.jar"} 2023-02-14T12:34:31.341Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-extensions-5.10.2.jar"} 2023-02-14T12:34:31.346Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-flowcontrol-5.10.2.jar"} 2023-02-14T12:34:31.348Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-metrics-5.10.2.jar"} 2023-02-14T12:34:31.357Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-networking-5.10.2.jar"} 2023-02-14T12:34:31.360Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-node-5.10.2.jar"} 2023-02-14T12:34:31.367Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-policy-5.10.2.jar"} 2023-02-14T12:34:31.372Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-rbac-5.10.2.jar"} 2023-02-14T12:34:31.373Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-scheduling-5.10.2.jar"} 2023-02-14T12:34:31.380Z DEBUG Parsing Java artifacts... {"file": "app/lib/kubernetes-model-storageclass-5.10.2.jar"} 2023-02-14T12:34:31.380Z DEBUG Parsing Java artifacts... {"file": "app/lib/lang-tag-1.6.jar"} 2023-02-14T12:34:31.386Z DEBUG Parsing Java artifacts... {"file": "app/lib/libphonenumber-8.11.1.jar"} 2023-02-14T12:34:31.387Z DEBUG Parsing Java artifacts... {"file": "app/lib/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar"} 2023-02-14T12:34:31.392Z DEBUG Parsing Java artifacts... {"file": "app/lib/log4j-api-2.17.2.jar"} 2023-02-14T12:34:31.393Z DEBUG Parsing Java artifacts... {"file": "app/lib/log4j-to-slf4j-2.17.2.jar"} 2023-02-14T12:34:31.398Z DEBUG Parsing Java artifacts... {"file": "app/lib/logback-classic-1.2.11.jar"} 2023-02-14T12:34:31.407Z DEBUG Parsing Java artifacts... {"file": "app/lib/logback-core-1.2.11.jar"} 2023-02-14T12:34:31.407Z DEBUG Parsing Java artifacts... {"file": "app/lib/logging-interceptor-4.9.3.jar"} 2023-02-14T12:34:31.419Z DEBUG Parsing Java artifacts... {"file": "app/lib/logstash-logback-encoder-6.6.jar"} 2023-02-14T12:34:31.459Z DEBUG Parsing Java artifacts... {"file": "app/lib/lombok-1.18.20.jar"} 2023-02-14T12:34:31.474Z DEBUG Parsing Java artifacts... {"file": "app/lib/lz4-java-1.8.0.jar"} 2023-02-14T12:34:31.481Z DEBUG Parsing Java artifacts... {"file": "app/lib/mailapi-1.6.2.jar"} 2023-02-14T12:34:31.482Z DEBUG Parsing Java artifacts... {"file": "app/lib/mapstruct-1.5.2.Final.jar"} 2023-02-14T12:34:31.484Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-artifact-3.8.5.jar"} 2023-02-14T12:34:31.484Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-builder-support-3.8.5.jar"} 2023-02-14T12:34:31.489Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-compat-3.8.5.jar"} 2023-02-14T12:34:31.503Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-core-3.8.5.jar"} 2023-02-14T12:34:31.507Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-model-3.8.5.jar"} 2023-02-14T12:34:31.511Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-model-builder-3.8.5.jar"} 2023-02-14T12:34:31.511Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-plugin-annotations-3.6.4.jar"} 2023-02-14T12:34:31.512Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-plugin-api-3.8.5.jar"} 2023-02-14T12:34:31.513Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-repository-metadata-3.8.5.jar"} 2023-02-14T12:34:31.516Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-resolver-api-1.6.3.jar"} 2023-02-14T12:34:31.519Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-resolver-impl-1.6.3.jar"} 2023-02-14T12:34:31.521Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-resolver-provider-3.8.5.jar"} 2023-02-14T12:34:31.522Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-resolver-spi-1.6.3.jar"} 2023-02-14T12:34:31.526Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-resolver-util-1.6.3.jar"} 2023-02-14T12:34:31.527Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-settings-3.8.5.jar"} 2023-02-14T12:34:31.528Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-settings-builder-3.8.5.jar"} 2023-02-14T12:34:31.529Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-shared-io-3.0.0.jar"} 2023-02-14T12:34:31.532Z DEBUG Parsing Java artifacts... {"file": "app/lib/maven-shared-utils-3.3.4.jar"} 2023-02-14T12:34:31.544Z DEBUG Parsing Java artifacts... {"file": "app/lib/micrometer-core-1.9.6.jar"} 2023-02-14T12:34:31.546Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-api-4.3.8.jar"} 2023-02-14T12:34:31.547Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-driver-api-4.3.8.jar"} 2023-02-14T12:34:31.547Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-driver-core-4.3.8.jar"} 2023-02-14T12:34:31.548Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-runner-core-4.3.8.jar"} 2023-02-14T12:34:31.549Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-spring-runner-util-4.3.8.jar"} 2023-02-14T12:34:31.549Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-spring-v5-4.3.8.jar"} 2023-02-14T12:34:31.550Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongock-utils-4.3.8.jar"} 2023-02-14T12:34:31.581Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongodb-driver-core-4.6.1.jar"} 2023-02-14T12:34:31.588Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongodb-driver-sync-4.6.1.jar"} 2023-02-14T12:34:31.592Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongodb-springdata-v3-driver-4.3.8.jar"} 2023-02-14T12:34:31.594Z DEBUG Parsing Java artifacts... {"file": "app/lib/mongodb-sync-v4-driver-4.3.8.jar"} 2023-02-14T12:34:31.598Z DEBUG Parsing Java artifacts... {"file": "app/lib/msal4j-1.12.0.jar"} 2023-02-14T12:34:31.599Z DEBUG Parsing Java artifacts... {"file": "app/lib/msal4j-persistence-extension-1.1.0.jar"} 2023-02-14T12:34:31.600Z DEBUG Parsing Java artifacts... {"file": "app/lib/msg-simple-1.2.jar"} 2023-02-14T12:34:31.607Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-buffer-4.1.85.Final.jar"} 2023-02-14T12:34:31.613Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-codec-4.1.85.Final.jar"} 2023-02-14T12:34:31.614Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-codec-dns-4.1.85.Final.jar"} 2023-02-14T12:34:31.628Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-codec-http-4.1.85.Final.jar"} 2023-02-14T12:34:31.639Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-codec-http2-4.1.85.Final.jar"} 2023-02-14T12:34:31.641Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-codec-socks-4.1.85.Final.jar"} 2023-02-14T12:34:31.653Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-common-4.1.85.Final.jar"} 2023-02-14T12:34:31.663Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-handler-4.1.85.Final.jar"} 2023-02-14T12:34:31.664Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-handler-proxy-4.1.85.Final.jar"} 2023-02-14T12:34:31.665Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-resolver-4.1.85.Final.jar"} 2023-02-14T12:34:31.668Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-resolver-dns-4.1.85.Final.jar"} 2023-02-14T12:34:31.669Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-resolver-dns-classes-macos-4.1.85.Final.jar"} 2023-02-14T12:34:31.670Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-resolver-dns-native-macos-4.1.85.Final-osx-x86_64.jar"} 2023-02-14T12:34:31.670Z DEBUG No such POM in the central repositories {"file": "netty-resolver-dns-native-macos-4.1.85.Final-osx-x86_64.jar"} 2023-02-14T12:34:32.669Z DEBUG POM was determined in a heuristic way {"file": "antlr-2.7.7.jar", "artifact": "antlr:antlr:2.7.7"} 2023-02-14T12:34:32.682Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final-linux-aarch_64.jar"} 2023-02-14T12:34:32.684Z DEBUG No such POM in the central repositories {"file": "netty-tcnative-boringssl-static-2.0.54.Final-linux-aarch_64.jar"} 2023-02-14T12:34:32.784Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final-linux-x86_64.jar"} 2023-02-14T12:34:32.786Z DEBUG No such POM in the central repositories {"file": "netty-tcnative-boringssl-static-2.0.54.Final-linux-x86_64.jar"} 2023-02-14T12:34:33.105Z DEBUG POM was determined in a heuristic way {"file": "guice-4.2.2-no_aop.jar", "artifact": "org.xbib:guice:4.2.2-no_aop"} 2023-02-14T12:34:33.114Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final-osx-aarch_64.jar"} 2023-02-14T12:34:33.116Z DEBUG No such POM in the central repositories {"file": "netty-tcnative-boringssl-static-2.0.54.Final-osx-aarch_64.jar"} 2023-02-14T12:34:33.509Z DEBUG POM was determined in a heuristic way {"file": "jcip-annotations-1.0.jar", "artifact": "org.lucee:jcip-annotations:1.0"} 2023-02-14T12:34:33.528Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final-osx-x86_64.jar"} 2023-02-14T12:34:33.531Z DEBUG No such POM in the central repositories {"file": "netty-tcnative-boringssl-static-2.0.54.Final-osx-x86_64.jar"} 2023-02-14T12:34:34.278Z DEBUG POM was determined in a heuristic way {"file": "netty-resolver-dns-native-macos-4.1.85.Final-osx-x86_64.jar", "artifact": "io.netty:netty-resolver-dns-native-macos:4.1.85.Final-osx-x86_64"} 2023-02-14T12:34:34.287Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final-windows-x86_64.jar"} 2023-02-14T12:34:34.289Z DEBUG No such POM in the central repositories {"file": "netty-tcnative-boringssl-static-2.0.54.Final-windows-x86_64.jar"} 2023-02-14T12:34:35.342Z DEBUG POM was determined in a heuristic way {"file": "netty-tcnative-boringssl-static-2.0.54.Final-linux-aarch_64.jar", "artifact": "io.netty:netty-tcnative-boringssl-static:2.0.54.Final-linux-aarch_64"} 2023-02-14T12:34:35.343Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-boringssl-static-2.0.54.Final.jar"} 2023-02-14T12:34:35.343Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-tcnative-classes-2.0.54.Final.jar"} 2023-02-14T12:34:35.352Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-4.1.85.Final.jar"} 2023-02-14T12:34:35.355Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-classes-epoll-4.1.85.Final.jar"} 2023-02-14T12:34:35.357Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-classes-kqueue-4.1.85.Final.jar"} 2023-02-14T12:34:35.358Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-native-epoll-4.1.85.Final-linux-x86_64.jar"} 2023-02-14T12:34:35.359Z DEBUG No such POM in the central repositories {"file": "netty-transport-native-epoll-4.1.85.Final-linux-x86_64.jar"} 2023-02-14T12:34:35.444Z DEBUG POM was determined in a heuristic way {"file": "netty-tcnative-boringssl-static-2.0.54.Final-linux-x86_64.jar", "artifact": "io.netty:netty-tcnative-boringssl-static:2.0.54.Final-linux-x86_64"} 2023-02-14T12:34:35.445Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-native-kqueue-4.1.85.Final-osx-x86_64.jar"} 2023-02-14T12:34:35.446Z DEBUG No such POM in the central repositories {"file": "netty-transport-native-kqueue-4.1.85.Final-osx-x86_64.jar"} 2023-02-14T12:34:35.788Z DEBUG POM was determined in a heuristic way {"file": "netty-tcnative-boringssl-static-2.0.54.Final-osx-aarch_64.jar", "artifact": "io.netty:netty-tcnative-boringssl-static:2.0.54.Final-osx-aarch_64"} 2023-02-14T12:34:35.789Z DEBUG Parsing Java artifacts... {"file": "app/lib/netty-transport-native-unix-common-4.1.85.Final.jar"} 2023-02-14T12:34:35.801Z DEBUG Parsing Java artifacts... {"file": "app/lib/nimbus-jose-jwt-9.22.jar"} 2023-02-14T12:34:35.817Z DEBUG Parsing Java artifacts... {"file": "app/lib/oauth2-oidc-sdk-9.35.jar"} 2023-02-14T12:34:35.835Z DEBUG Parsing Java artifacts... {"file": "app/lib/okhttp-4.9.3.jar"} 2023-02-14T12:34:35.841Z DEBUG Parsing Java artifacts... {"file": "app/lib/okio-2.8.0.jar"} 2023-02-14T12:34:35.976Z DEBUG Parsing Java artifacts... {"file": "app/lib/openapi-generator-6.2.1.jar"} 2023-02-14T12:34:35.980Z DEBUG Parsing Java artifacts... {"file": "kotlin-client/gradle-wrapper.jar"} 2023-02-14T12:34:35.981Z DEBUG No such POM in the central repositories {"file": "gradle-wrapper.jar"} 2023-02-14T12:34:35.981Z DEBUG Parsing Java artifacts... {"file": "java-micronaut/common/configuration/gradlew/gradle-wrapper.jar"} 2023-02-14T12:34:35.981Z DEBUG Failed to parse java-micronaut/common/configuration/gradlew/gradle-wrapper.jar: failed to parse java-micronaut/common/configuration/gradlew/gradle-wrapper.jar: zip error: zip: not a valid zip file 2023-02-14T12:34:35.982Z DEBUG Parsing Java artifacts... {"file": "Java/gradle-wrapper.jar"} 2023-02-14T12:34:35.983Z DEBUG No such POM in the central repositories {"file": "gradle-wrapper.jar"} 2023-02-14T12:34:35.984Z DEBUG Parsing Java artifacts... {"file": "scala-httpclient/gradle-wrapper.jar"} 2023-02-14T12:34:35.985Z DEBUG No such POM in the central repositories {"file": "gradle-wrapper.jar"} 2023-02-14T12:34:35.986Z DEBUG Parsing Java artifacts... {"file": "android/gradle-wrapper.jar"} 2023-02-14T12:34:35.986Z DEBUG No such POM in the central repositories {"file": "gradle-wrapper.jar"} 2023-02-14T12:34:35.988Z DEBUG Parsing Java artifacts... {"file": "app/lib/openapi-generator-core-6.2.1.jar"} 2023-02-14T12:34:35.989Z DEBUG Parsing Java artifacts... {"file": "app/lib/openapi-generator-maven-plugin-6.2.1.jar"} 2023-02-14T12:34:35.996Z DEBUG Parsing Java artifacts... {"file": "app/lib/org.eclipse.sisu.inject-0.3.5.jar"} 2023-02-14T12:34:36.001Z DEBUG Parsing Java artifacts... {"file": "app/lib/org.eclipse.sisu.plexus-0.3.5.jar"} 2023-02-14T12:34:36.002Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-build-api-0.0.7.jar"} 2023-02-14T12:34:36.002Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-cipher-2.0.jar"} 2023-02-14T12:34:36.003Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-classworlds-2.6.0.jar"} 2023-02-14T12:34:36.003Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-component-annotations-2.1.0.jar"} 2023-02-14T12:34:36.005Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-interpolation-1.26.jar"} 2023-02-14T12:34:36.006Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-sec-dispatcher-2.0.jar"} 2023-02-14T12:34:36.010Z DEBUG Parsing Java artifacts... {"file": "app/lib/plexus-utils-3.0.24.jar"} 2023-02-14T12:34:36.026Z DEBUG Parsing Java artifacts... {"file": "app/lib/proton-j-0.33.8.jar"} 2023-02-14T12:34:36.028Z DEBUG Parsing Java artifacts... {"file": "app/lib/qpid-proton-j-extensions-1.2.4.jar"} 2023-02-14T12:34:36.028Z DEBUG Parsing Java artifacts... {"file": "app/lib/reactive-streams-1.0.4.jar"} 2023-02-14T12:34:36.068Z DEBUG Parsing Java artifacts... {"file": "app/lib/reactor-core-3.4.25.jar"} 2023-02-14T12:34:36.083Z DEBUG Parsing Java artifacts... {"file": "app/lib/reactor-netty-core-1.0.25.jar"} 2023-02-14T12:34:36.092Z DEBUG Parsing Java artifacts... {"file": "app/lib/reactor-netty-http-1.0.25.jar"} 2023-02-14T12:34:36.096Z DEBUG Parsing Java artifacts... {"file": "app/lib/reflections-0.9.9.jar"} 2023-02-14T12:34:36.098Z DEBUG Parsing Java artifacts... {"file": "app/lib/rgxgen-1.3.jar"} 2023-02-14T12:34:36.120Z DEBUG Parsing Java artifacts... {"file": "app/lib/rhino-1.7.7.2.jar"} 2023-02-14T12:34:36.123Z DEBUG Parsing Java artifacts... {"file": "app/lib/slf4j-api-1.7.36.jar"} 2023-02-14T12:34:36.125Z DEBUG Parsing Java artifacts... {"file": "app/lib/slf4j-ext-1.7.36.jar"} 2023-02-14T12:34:36.131Z DEBUG Parsing Java artifacts... {"file": "app/lib/snakeyaml-1.33.jar"} 2023-02-14T12:34:36.162Z DEBUG Parsing Java artifacts... {"file": "app/lib/snappy-java-1.1.8.4.jar"} 2023-02-14T12:34:36.173Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-aop-5.3.24.jar"} 2023-02-14T12:34:36.175Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-aspects-5.3.24.jar"} 2023-02-14T12:34:36.190Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-batch-core-4.3.7.jar"} 2023-02-14T12:34:36.201Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-batch-infrastructure-4.3.7.jar"} 2023-02-14T12:34:36.211Z DEBUG POM was determined in a heuristic way {"file": "netty-tcnative-boringssl-static-2.0.54.Final-osx-x86_64.jar", "artifact": "io.netty:netty-tcnative-boringssl-static:2.0.54.Final-osx-x86_64"} 2023-02-14T12:34:36.217Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-beans-5.3.24.jar"} 2023-02-14T12:34:36.244Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-boot-2.7.6.jar"} 2023-02-14T12:34:36.258Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-boot-actuator-2.7.6.jar"} 2023-02-14T12:34:36.267Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-boot-actuator-autoconfigure-2.7.6.jar"} 2023-02-14T12:34:36.300Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-boot-autoconfigure-2.7.6.jar"} 2023-02-14T12:34:36.300Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-boot-jarmode-layertools-2.7.6.jar"} 2023-02-14T12:34:36.311Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-azure-autoconfigure-4.3.0.jar"} 2023-02-14T12:34:36.314Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-azure-core-4.3.0.jar"} 2023-02-14T12:34:36.317Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-azure-service-4.3.0.jar"} 2023-02-14T12:34:36.317Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-azure-starter-4.3.0.jar"} 2023-02-14T12:34:36.317Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-azure-starter-active-directory-4.3.0.jar"} 2023-02-14T12:34:36.324Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-commons-3.1.3.jar"} 2023-02-14T12:34:36.325Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-config-client-3.1.3.jar"} 2023-02-14T12:34:36.330Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-context-3.1.3.jar"} 2023-02-14T12:34:36.331Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-kubernetes-commons-2.1.3.jar"} 2023-02-14T12:34:36.332Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-kubernetes-fabric8-autoconfig-2.1.3.jar"} 2023-02-14T12:34:36.333Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-kubernetes-fabric8-config-2.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-kubernetes-fabric8-discovery-2.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-starter-3.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-starter-config-3.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-starter-bootstrap-3.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-starter-kubernetes-fabric8-2.1.3.jar"} 2023-02-14T12:34:36.334Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-cloud-starter-kubernetes-fabric8-config-2.1.3.jar"} 2023-02-14T12:34:36.358Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-context-5.3.24.jar"} 2023-02-14T12:34:36.361Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-context-support-5.3.24.jar"} 2023-02-14T12:34:36.389Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-core-5.3.24.jar"} 2023-02-14T12:34:36.420Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-data-commons-2.7.6.jar"} 2023-02-14T12:34:36.427Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-data-jpa-2.7.6.jar"} 2023-02-14T12:34:36.466Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-data-mongodb-3.4.6.jar"} 2023-02-14T12:34:36.468Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-data-rest-core-3.7.6.jar"} 2023-02-14T12:34:36.477Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-data-rest-webmvc-3.7.6.jar"} 2023-02-14T12:34:36.483Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-expression-5.3.24.jar"} 2023-02-14T12:34:36.493Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-hateoas-1.5.2.jar"} 2023-02-14T12:34:36.493Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-jcl-5.3.24.jar"} 2023-02-14T12:34:36.501Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-jdbc-5.3.24.jar"} 2023-02-14T12:34:36.514Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-kafka-2.8.11.jar"} 2023-02-14T12:34:36.524Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-messaging-5.3.24.jar"} 2023-02-14T12:34:36.530Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-orm-5.3.24.jar"} 2023-02-14T12:34:36.532Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-plugin-core-2.0.0.RELEASE.jar"} 2023-02-14T12:34:36.534Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-retry-1.3.4.jar"} 2023-02-14T12:34:36.561Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-config-5.7.5.jar"} 2023-02-14T12:34:36.569Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-core-5.7.5.jar"} 2023-02-14T12:34:36.570Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-crypto-5.7.5.jar"} 2023-02-14T12:34:36.571Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-jwt-1.0.9.RELEASE.jar"} 2023-02-14T12:34:36.580Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-2.5.2.RELEASE.jar"} 2023-02-14T12:34:36.581Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-autoconfigure-2.1.2.RELEASE.jar"} 2023-02-14T12:34:36.590Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-client-5.7.5.jar"} 2023-02-14T12:34:36.592Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-core-5.7.5.jar"} 2023-02-14T12:34:36.594Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-jose-5.7.5.jar"} 2023-02-14T12:34:36.596Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-oauth2-resource-server-5.7.5.jar"} 2023-02-14T12:34:36.597Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-rsa-1.0.10.RELEASE.jar"} 2023-02-14T12:34:36.609Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-security-web-5.7.5.jar"} 2023-02-14T12:34:36.611Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-session-core-2.7.0.jar"} 2023-02-14T12:34:36.617Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-tx-5.3.24.jar"} 2023-02-14T12:34:36.652Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-web-5.3.24.jar"} 2023-02-14T12:34:36.671Z DEBUG Parsing Java artifacts... {"file": "app/lib/spring-webmvc-5.3.24.jar"} 2023-02-14T12:34:36.677Z DEBUG Parsing Java artifacts... {"file": "app/lib/springdoc-openapi-common-1.6.9.jar"} 2023-02-14T12:34:36.677Z DEBUG Parsing Java artifacts... {"file": "app/lib/springdoc-openapi-ui-1.6.9.jar"} 2023-02-14T12:34:36.678Z DEBUG Parsing Java artifacts... {"file": "app/lib/springdoc-openapi-webmvc-core-1.6.9.jar"} 2023-02-14T12:34:36.689Z DEBUG Parsing Java artifacts... {"file": "app/lib/sqljdbc4-4.0.jar"} 2023-02-14T12:34:36.692Z DEBUG Parsing Java artifacts... {"file": "app/lib/stax2-api-4.2.1.jar"} 2023-02-14T12:34:36.693Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-annotations-1.6.6.jar"} 2023-02-14T12:34:36.693Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-annotations-2.2.0.jar"} 2023-02-14T12:34:36.697Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-compat-spec-parser-1.0.63.jar"} 2023-02-14T12:34:36.699Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-core-1.6.8.jar"} 2023-02-14T12:34:36.703Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-core-2.2.0.jar"} 2023-02-14T12:34:36.706Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-models-1.6.8.jar"} 2023-02-14T12:34:36.711Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-models-2.2.4.jar"} 2023-02-14T12:34:36.713Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-parser-2.1.6.jar"} 2023-02-14T12:34:36.713Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-parser-1.0.63.jar"} 2023-02-14T12:34:36.713Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-parser-core-2.1.6.jar"} 2023-02-14T12:34:36.713Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-parser-v2-converter-2.1.6.jar"} 2023-02-14T12:34:36.716Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-parser-v3-2.1.6.jar"} 2023-02-14T12:34:36.754Z DEBUG Parsing Java artifacts... {"file": "app/lib/swagger-ui-4.11.1.jar"} 2023-02-14T12:34:36.764Z DEBUG Parsing Java artifacts... {"file": "app/lib/threetenbp-1.4.0.jar"} 2023-02-14T12:34:36.842Z DEBUG Parsing Java artifacts... {"file": "app/lib/tomcat-embed-core-9.0.69.jar"} 2023-02-14T12:34:36.847Z DEBUG Parsing Java artifacts... {"file": "app/lib/tomcat-embed-el-9.0.69.jar"} 2023-02-14T12:34:36.853Z DEBUG Parsing Java artifacts... {"file": "app/lib/tomcat-embed-websocket-9.0.69.jar"} 2023-02-14T12:34:36.855Z DEBUG Parsing Java artifacts... {"file": "app/lib/txw2-2.3.7.jar"} 2023-02-14T12:34:36.855Z DEBUG Parsing Java artifacts... {"file": "app/lib/uri-template-0.10.jar"} 2023-02-14T12:34:36.857Z DEBUG Parsing Java artifacts... {"file": "app/lib/validation-api-2.0.1.Final.jar"} 2023-02-14T12:34:36.858Z DEBUG Parsing Java artifacts... {"file": "app/lib/wagon-provider-api-3.5.1.jar"} 2023-02-14T12:34:36.858Z DEBUG Parsing Java artifacts... {"file": "app/lib/webjars-locator-core-0.50.jar"} 2023-02-14T12:34:36.889Z DEBUG Parsing Java artifacts... {"file": "app/lib/woodstox-core-6.4.0.jar"} 2023-02-14T12:34:36.889Z DEBUG Parsing Java artifacts... {"file": "app/lib/zjsonpatch-0.3.0.jar"} 2023-02-14T12:34:36.992Z DEBUG Parsing Java artifacts... {"file": "app/lib/zstd-jni-1.5.0-4.jar"} 2023-02-14T12:34:37.030Z DEBUG POM was determined in a heuristic way {"file": "netty-tcnative-boringssl-static-2.0.54.Final-windows-x86_64.jar", "artifact": "io.netty:netty-tcnative-boringssl-static:2.0.54.Final-windows-x86_64"} 2023-02-14T12:34:37.955Z DEBUG POM was determined in a heuristic way {"file": "netty-transport-native-epoll-4.1.85.Final-linux-x86_64.jar", "artifact": "io.netty:netty-transport-native-epoll:4.1.85.Final-linux-x86_64"} 2023-02-14T12:34:38.025Z DEBUG POM was determined in a heuristic way {"file": "netty-transport-native-kqueue-4.1.85.Final-osx-x86_64.jar", "artifact": "io.netty:netty-transport-native-kqueue:4.1.85.Final-osx-x86_64"} 2023-02-14T12:34:38.240Z DEBUG No secrets found in container image config 2023-02-14T12:34:38.252Z INFO Detected OS: alpine 2023-02-14T12:34:38.252Z INFO Detecting Alpine vulnerabilities... 2023-02-14T12:34:38.252Z DEBUG alpine: os version: 3.15 2023-02-14T12:34:38.252Z DEBUG alpine: package repository: 3.15 2023-02-14T12:34:38.252Z DEBUG alpine: the number of packages: 35 2023-02-14T12:34:38.254Z INFO Number of language-specific files: 1 2023-02-14T12:34:38.254Z INFO Detecting jar vulnerabilities... 2023-02-14T12:34:38.254Z DEBUG Detecting library vulnerabilities, type: jar, path: 2023-02-14T12:34:38.269Z INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Java (jar)

Total: 12 (UNKNOWN: 1, LOW: 0, MEDIUM: 7, HIGH: 1, CRITICAL: 3)

┌─────────────────────────────────────────────────────────────┬─────────────────────┬──────────┬───────────────────┬───────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ io.fabric8:kubernetes-client (kubernetes-client-5.10.2.jar) │ GHSA-98g7-rxmf-rrxm │ UNKNOWN │ 5.10.2 │ 5.0.3, 5.1.2, 5.3.2, 5.7.4, 5.8.1, 5.11.2 │ Improper Neutralization of Special Elements used in an OS │ │ │ │ │ │ │ Command ('OS Command... │ │ │ │ │ │ │ https://github.com/advisories/GHSA-98g7-rxmf-rrxm │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ io.netty:netty-codec-http │ CVE-2022-41915 │ MEDIUM │ 4.1.85.Final │ 4.1.86 │ Netty project is an event-driven asynchronous network │ │ (netty-codec-http-4.1.85.Final.jar) │ │ │ │ │ application fram ... │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-41915 │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ org.apache.commons:commons-text (handlebars-4.2.1.jar) │ CVE-2022-42889 │ CRITICAL │ 1.8 │ 1.10.0 │ apache-commons-text: variable interpolation RCE │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-42889 │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ org.bouncycastle:bcprov-jdk15on (bcprov-jdk15on-1.56.jar) │ CVE-2020-15522 │ MEDIUM │ 1.56 │ 1.66 │ bouncycastle: Timing issue within the EC math library │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-15522 │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ org.hsqldb:hsqldb (hsqldb-2.5.2.jar) │ CVE-2022-41853 │ CRITICAL │ 2.5.2 │ 2.7.1 │ hsqldb: Untrusted input may lead to RCE attack │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-41853 │ ├─────────────────────────────────────────────────────────────┼─────────────────────┤ ├───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ org.springframework:spring-web (spring-web-5.3.24.jar) │ CVE-2016-1000027 │ │ 5.3.24 │ 6.0.0 │ spring: HttpInvokerServiceExporter readRemoteInvocation │ │ │ │ │ │ │ method untrusted java deserialization │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2016-1000027 │ ├─────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ org.yaml:snakeyaml (dd-java-agent.jar) │ CVE-2022-25857 │ HIGH │ 1.26 │ 1.31 │ snakeyaml: Denial of Service due to missing nested depth │ │ │ │ │ │ │ limitation for collections... │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25857 │ │ ├─────────────────────┼──────────┤ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2022-38749 │ MEDIUM │ │ │ snakeyaml: Uncaught exception in │ │ │ │ │ │ │ org.yaml.snakeyaml.composer.Composer.composeSequenceNode │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38749 │ │ ├─────────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2022-38750 │ │ │ │ snakeyaml: Uncaught exception in │ │ │ │ │ │ │ org.yaml.snakeyaml.constructor.BaseConstructor.constructObj- │ │ │ │ │ │ │ ect │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38750 │ │ ├─────────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2022-38751 │ │ │ │ snakeyaml: Uncaught exception in │ │ │ │ │ │ │ java.base/java.util.regex.Pattern$Ques.match │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38751 │ │ ├─────────────────────┤ │ ├───────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2022-38752 │ │ │ 1.32 │ snakeyaml: Uncaught exception in │ │ │ │ │ │ │ java.base/java.util.ArrayList.hashCode │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38752 │ │ ├─────────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2022-41854 │ │ │ │ dev-java/snakeyaml: DoS via stack overflow │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-41854 │ └─────────────────────────────────────────────────────────────┴─────────────────────┴──────────┴───────────────────┴───────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

there you can see that trivy scans the correct jar file 2023-02-14T12:34:36.131Z DEBUG Parsing Java artifacts... {"file": "app/lib/snakeyaml-1.33.jar"}

But in the report it shows that v.1.26 is installed. image

AndreyLevchenko commented 1 year ago

@StevDa86 from response you sent I see it goes from dd-java-agent.jar I would examine this jar manually. Probably 1.26 is included as a jar within jar.

StevDa86 commented 1 year ago

Thank you, that was the problem.