From 100k to 1M lookups per month for just $99/year.

New Community+ plan

Spectra Assure

Community

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

Maven

Search by package name, PURL or hash

warningRisk: Hardening

Scanned:

com.vaadin:license-checker

Artifact:

latest

Top 10k

A parent POM for all artifacts by Vaadin Ltd.

License: Permissive (Apache-2.0)

Published:

See on Maven

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

21 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

1 baseline mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues9 vulnerabilities0 malware0 behaviors107 dependencies4 contributors1 versions85

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

The stack is a special program segment which is writable by design, and is commonly used to store function-specific data and execution context. Granting execution privileges to the stack segment reduces application security, because it makes it possible to execute arbitrary code stored on the stack. While many modern compilers will implement a non-executable stack by default, it can be unintentionally disabled or made explicitly executable in automatically generated or misconfigured compiler options.

Prevalence in Maven community

No prevalence information at this time

Next steps

Enable non-executable stack mitigation with the -z noexecstack parameter during compilation.

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). The global offset table is split into two tables - one for external data, and one for external functions. Without any protection, both are writable at runtime and thus leave the executable vulnerable to data overwrite attacks and pointer hijacking. Data overwrite attacks can be mitigated by using partial read-only relocations, while pointer hijacking can be mitigated with full read-only relocations. Both approaches have some drawbacks. Partial read-only relocations don't provide full protection, because the external function GOT remains writable. Full read-only relocations require that all external function symbols are resolved at load-time instead of during execution. This may increase loading time for large programs.

Prevalence in Maven community

No prevalence information at this time

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

No vulnerabilities found.

FAQ for com.vaadin:license-checker

What is com.vaadin:license-checker?

A parent POM for all artifacts by Vaadin Ltd. For more information about this package, visit its homepage.

Is com.vaadin:license-checker malicious or is it safe to use?

The Java package com.vaadin:license-checker was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Does com.vaadin:license-checker have known vulnerabilities?

No vulnerabilities have been detected for this version of com.vaadin:license-checker.

Is com.vaadin:license-checker popular?

The Java package com.vaadin:license-checker ranks among the top 10000 projects in this community. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

Read our best practices for protecting your software supply chain guide.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Enable non-executable stack mitigation with the -z noexecstack parameter during compilation.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

No vulnerabilities found.

com.vaadin:license-checker

SAFE Assessment

Compliance

Security

Threats

Popularity

Top issues

SQ18101Detected Linux executable files that declare the stack as executable, making non-executable memory mitigations less effective.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Maven community

Next steps

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18112Detected Linux executable files that were compiled without any dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Maven community

Next steps

Top behaviors

Encodes data using the Base64 algorithm.packer

Prevalence in Maven community

Decodes data using the Base64 algorithm.packer

Prevalence in Maven community

Creates a process.execution

Prevalence in Maven community

Enumerates the computer's network interfaces.search

Prevalence in Maven community

Queries the computer's network name and IP address.network

Prevalence in Maven community

Top vulnerabilities

FAQ for com.vaadin:license-checker

What is com.vaadin:license-checker?

Is com.vaadin:license-checker malicious or is it safe to use?

Does com.vaadin:license-checker have known vulnerabilities?

Is com.vaadin:license-checker popular?

Did you know...

Popularity

Top issues

SQ18101Detected Linux executable files that declare the stack as executable, making non-executable memory mitigations less effective.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Maven community

Next steps

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18112Detected Linux executable files that were compiled without any dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Maven community

Next steps

Top behaviors

Encodes data using the Base64 algorithm.packer

Prevalence in Maven community

Decodes data using the Base64 algorithm.packer

Prevalence in Maven community

Creates a process.execution

Prevalence in Maven community

Enumerates the computer's network interfaces.search

Prevalence in Maven community

Queries the computer's network name and IP address.network

Prevalence in Maven community

Top vulnerabilities