neilc1964techned/craready-test-java-vulnsCRAReady SBOM test fixture — Java/Maven app with Log4Shell (CVE-2021-44228), Spring4Shell, Text4Shell, and other critical CVEs
CRAReady SBOM/CVE scanner test fixture — DO NOT USE IN PRODUCTION
This repository contains intentionally vulnerable Java (Maven) dependencies for testing the CRAReady SBOM generation and vulnerability detection pipeline. Includes some of the most significant CVEs of recent years.
| Package | Version | CVE | CVSS | Description |
|---|
| log4j-core | 2.14.1 | CVE-2021-44228 | 10.0 Critical | Log4Shell — remote code execution via JNDI lookup in log messages |
| log4j-core | 2.14.1 | CVE-2021-45046 | 9.0 Critical | Log4Shell bypass via ${::-j} pattern |
| log4j-api | 2.14.1 | CVE-2021-44228 | 10.0 Critical | Same Log4Shell vector |
| spring-webmvc | 5.3.17 | CVE-2022-22965 | 9.8 Critical | Spring4Shell — RCE via data binding |
| spring-core | 5.3.17 | CVE-2022-22965 | 9.8 Critical | Spring4Shell |
| commons-text | 1.9 | CVE-2022-42889 | 9.8 Critical | Text4Shell — RCE via ${script:...} interpolation |
| jackson-databind | 2.13.3 | CVE-2022-42003 | 7.5 High | Deep wrapper array nesting DoS |
| jackson-databind | 2.13.3 | CVE-2022-42004 | 7.5 High | Deep wrapper array nesting DoS variant |
| snakeyaml | 1.30 | CVE-2022-25857 | 7.5 High | DoS via stack overflow in YAML parsing |
| snakeyaml | 1.30 | CVE-2022-38750 | 6.5 Medium | DoS via recursive YAML tags |
Use this repo as an SBOM scan target in CRAReady:
These are chosen because they are:
