Openssl added

Author: thribhuvant

README.md

@@ -24,18 +24,25 @@ test_java_dependency_issues_repo/
 └── README.md
 ```
 
-## Vulnerable Dependency
+## Vulnerable Dependencies
 
-This project includes **Log4j 2.14.1**, which contains the critical **CVE-2021-44228** vulnerability (also known as Log4Shell).
+This project includes multiple vulnerable dependencies for testing purposes:
 
-**⚠️ WARNING**: This vulnerability is intentionally included for testing purposes only. Do not use this project in production environments.
+**⚠️ WARNING**: These vulnerabilities are intentionally included for testing purposes only. Do not use this project in production environments.
 
-### Vulnerability Details
+### 1. Log4j Vulnerability
 - **Dependency**: `org.apache.logging.log4j:log4j-core:2.14.1`
-- **CVE**: CVE-2021-44228
+- **CVE**: CVE-2021-44228 (Log4Shell)
 - **Severity**: Critical (CVSS 10.0)
 - **Description**: Remote code execution vulnerability in Log4j
 
+### 2. OpenSSL Vulnerability (via Netty)
+- **Dependency**: `io.netty:netty-tcnative-boringssl-static:2.0.20.Final`
+- **OpenSSL Version**: 1.0.2r (bundled)
+- **CVEs**: CVE-2019-1543, CVE-2019-1547, CVE-2019-1563
+- **Severity**: High
+- **Description**: Multiple vulnerabilities in OpenSSL 1.0.2r including padding oracle attacks and side-channel attacks
+
 ## Building the Project
 
 ```bash
@@ -54,14 +61,18 @@ This project includes **Log4j 2.14.1**, which contains the critical **CVE-2021-4
 ./gradlew test
 ```
 
-## Fixing the Vulnerability
+## Fixing the Vulnerabilities
 
-To fix the vulnerability, upgrade Log4j to version 2.17.1 or later:
+To fix the vulnerabilities, upgrade to secure versions:
 
 ```gradle
 dependencies {
+    // Fixed Log4j version
     implementation 'org.apache.logging.log4j:log4j-core:2.17.1'
     implementation 'org.apache.logging.log4j:log4j-api:2.17.1'
+    
+    // Fixed Netty tcnative version (uses updated OpenSSL/BoringSSL)
+    implementation 'io.netty:netty-tcnative-boringssl-static:2.0.54.Final'
 }
 ```
 

build.gradle

@@ -16,6 +16,10 @@ dependencies {
     implementation 'org.apache.logging.log4j:log4j-core:2.14.1'
     implementation 'org.apache.logging.log4j:log4j-api:2.14.1'
 
+    // Vulnerable OpenSSL dependency - Netty with tcnative using OpenSSL 1.0.2r
+    // Contains multiple CVEs including CVE-2019-1543, CVE-2019-1547, CVE-2019-1563
+    implementation 'io.netty:netty-tcnative-boringssl-static:2.0.20.Final'
+    
     // Testing dependencies
     testImplementation 'org.junit.jupiter:junit-jupiter-api:5.8.2'
     testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.8.2'