I have developed a tool that can find Maven Central JAR artifacts that contain classes from known vulnerable JAR artifacts. This includes but is not limited to fat (uber) JARs, JAR bundles, and artifacts tagged with the -all identifier.

In the course of my research, I have found a multitude (tens of thousands) of JAR artifacts available on the Maven Central repository that contain all the classes from several widely-known vulnerable artifacts. Crucially, these classes are not merely referenced as dependencies of these artifacts; they are directly included within the JARs themselves.

Given this context, my query revolves around the appropriate course of action: Should these artifacts be reported and labeled as vulnerable due to their contents, or is it commonplace for such artifacts to remain unmarked as vulnerable?

For example, Facebook's ranger-apache JAR, which is used in 72 components as per Sonatype's database, contains all the classes of [email protected], which is known to contain a security vulnerability.

  • You should probably ask the repository providers directly. Some websites like mvnrepository.com already have a vulnerabilities indicator to list CVEs for known-vulnerable packages. If you can offer more accurate data, they might be interested. Or create your own website which presents the results in a searchable form.
    – Ja1024
    Commented Mar 3 at 17:42
  • @Ja1024, the problem is that no one is responding or reacting to my heads-up calls.
    – Cornul11
    Commented Mar 10 at 14:41


You must log in to answer this question.

Browse other questions tagged .