org.eclipse.jgit:org.eclipse.jgit.ssh.apache

Artifact:

SSH support for JGit based on Apache MINA sshd

License: Permissive (BSD-3-Clause)

Published:

See on Maven

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

1 medium severity vulnerabilities

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues2 vulnerabilities1 malware0 behaviors25 dependencies5 contributors19 versions59

Popularity

N/A

Total Downloads

Contributors

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in Maven community

No prevalence information at this time

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures are made using digital certificates, which can either be purchased from certificate authorities or be self-issued. When a certificate is purchased from a certificate authority, the subject that requests it goes through an identity validation process. Depending on the certificate type, those checks can be basic or extended. Confirming the subject identity is a multi-step process, and the requesting subject can be mapped to its legal entity name only through extended validation of submitted documents. Extended identity validation typically costs more, and it takes longer for a certificate to be issued when this process is correctly followed.

Prevalence in Maven community

No prevalence information at this time

Next steps

Consider the benefits of acquiring extended validation certificates. Operating systems tend to be more trusting of software packages signed in this way. Certain security warnings and prompts might also be automatically suppressed. This reduces the number of support tickets for organizations that opt to use extended validation certificates.