Update dependency org.pac4j:pac4j-jwt to v5 (main) - #250
Update dependency org.pac4j:pac4j-jwt to v5 (main)#250mend-for-github-com[bot] wants to merge 1 commit into
Security Report
❗️Scan Incomplete: The scan completed with partial failure. The integration encountered issues with one or more projects in this repository, preventing their scan. The errors occurred in the following package managers: gradle,sbt,php. Consequently, there may be gaps in the coverage of open-source dependencies used in the repository.
Scan Details Report
gradle
/tmp/ws-scm/comms-router/test/demo-helper/play-helper/build.gradle
| Step | Level | Description | Details |
|---|---|---|---|
| Preparing the project for scan | ⚠Warn | One or more of the installations failed | failed running mend init script (mendDeps): NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED FAILURE: Build failed with an exception. * Where: Build file '/tmp/ws-scm/comms-router/test/demo-helper/play-helper/build.gradle' line: 2 * What went wrong: Plugin [id: 'play'] was not found in any o... |
https://vonagecc.jfrog.io/artifactory
| Step | Level | Description | Details |
|---|---|---|---|
| Checking registry connectivity | ⚠Warn | Problem occurred while connecting to the private registry host server, private registry returned 401 - Unauthorized | {"errors":[{"code":"UNAUTHORIZED","message":"Invalid token, parse"}]} |
https://vonagecc.jfrog.io/artifactory/maven
| Step | Level | Description | Details |
|---|---|---|---|
| Checking registry connectivity | ⚠Warn | Problem occurred while connecting to the private registry host server, private registry returned 401 - Unauthorized | {"errors":[{"code":"UNAUTHORIZED","message":"Invalid token, parse"}]} |
You have successfully remediated 15 vulnerabilities, but introduced 16 new vulnerabilities in this branch.❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Exploit Maturity | EPSS | Vulnerable Library | Direct Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|---|---|---|
CVE-2026-29000Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/pac4j/pac4j-jwt/5.4.1/pac4j-jwt-5.4.1.jar Dependency Hierarchy: -> ❌ pac4j-jwt-5.4.1.jar (Vulnerable Library) |
 Critical |
9.1 | Not Defined | 0.068% | Direct pac4j-jwt-5.4.1.jar |
pac4j-jwt-5.4.1.jar | 5.7.9 | None | |
CVE-2024-30172Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
 High |
7.5 | Not Defined | 0.077% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1 |
#147 | |
CVE-2024-29857Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 0.191% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1 |
#147 | |
CVE-2019-17359Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 3.325% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.64 |
#147 | |
CVE-2018-1000180Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 0.319% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.57 |
#147 | |
CVE-2016-1000343Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 1.074% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.56 |
#147 | |
CVE-2016-1000342Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 0.471% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.56 |
#147 | |
CVE-2016-1000338Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.5 | Not Defined | 0.381% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.56 |
#147 | |
CVE-2016-1000344Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
High |
7.4 | Not Defined | 0.388% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.56 |
#147 | |
CVE-2024-30171Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
 Medium |
5.9 | Not Defined | 0.105% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1 |
#147 | |
CVE-2020-15522Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
Medium |
5.9 | Not Defined | 0.414% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.66 |
#147 | |
CVE-2016-1000341Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
Medium |
5.9 | Not Defined | 0.802% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.56 |
#147 | |
CVE-2023-33202Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
Medium |
5.5 | Not Defined | 0.144% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73 |
#147 | |
CVE-2023-33201Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
Medium |
5.3 | Not Defined | 0.326% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74 |
#147 | |
CVE-2020-26939Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
Medium |
5.3 | Not Defined | 2.437% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.61 |
#147 | |
CVE-2015-6644Path to dependency file: /web/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar Dependency Hierarchy: -> pac4j-saml-2.3.1.jar (Root Library) -> opensaml-saml-api-3.3.0.jar -> opensaml-xmlsec-api-3.3.0.jar -> opensaml-security-api-3.3.0.jar -> ❌ bcprov-jdk15on-1.54.jar (Vulnerable Library) |
 Low |
3.3 | Not Defined | 0.184% | Transitive bcprov-jdk15on-1.54.jar |
pac4j-saml-2.3.1.jar | Transitive 1.55 |
#147 |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2025-53864 | nimbus-jose-jwt-4.41.2.jar |
| CVE-2024-30171 | bcprov-jdk15on-1.56.jar |
| CVE-2023-1370 | json-smart-2.3.jar |
| CVE-2021-27568 | json-smart-2.3.jar |
| CVE-2023-52428 | nimbus-jose-jwt-4.41.2.jar |
| CVE-2019-17359 | bcprov-jdk15on-1.56.jar |
| CVE-2020-26939 | bcprov-jdk15on-1.56.jar |
| CVE-2018-1000180 | bcprov-jdk15on-1.56.jar |
| CVE-2024-30172 | bcprov-jdk15on-1.56.jar |
| CVE-2023-33201 | bcprov-jdk15on-1.56.jar |
| CVE-2020-15522 | bcprov-jdk15on-1.56.jar |
| CVE-2024-29857 | bcprov-jdk15on-1.56.jar |
| CVE-2019-17195 | nimbus-jose-jwt-4.41.2.jar |
| CVE-2023-33202 | bcprov-jdk15on-1.56.jar |
| CVE-2026-29000 | pac4j-jwt-2.3.1.jar |
Base branch total remaining vulnerabilities: 197
Base branch commit: 4e5656db54be4b22481fe3774c2caeba51bac190
Total libraries scanned: 229
Scan token: c4aad7d7dc754d709f77efc5bce6289b