OWASP giving security error on Chronicle-Logger

[eix128]

hi i tried owasp security on your library but i got error as shown below:

MAVEN DEPENDENCY

org.owasp
dependency-check-maven
6.5.3

true
true

ERROR:

One or more dependencies were identified with known vulnerabilities in LabiysWebService:
chronicle-wire-2.22ea11.jar (pkg:maven/net.openhft/chronicle-wire@2.22ea11, cpe:2.3:a:wire:wire:2.22.ea11:::::::*) : CVE-2018-8909, CVE-2020-15258, CVE-2020-27853, CVE-2021-21301, CVE-2021-32665, CVE-2021-32666, CVE-2021-32755,
CVE-2021-41093`

kotlin-stdlib-1.4.10.jar (pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@1.4.10, cpe:2.3:a:jetbrains:kotlin:1.4.10:*:*:*:*:*:*:*) : CVE-2020-29582
kotlin-stdlib-common-1.4.0.jar (pkg:maven/org.jetbrains.kotlin/kotlin-stdlib-common@1.4.0, cpe:2.3:a:jetbrains:kotlin:1.4.0:*:*:*:*:*:*:*) : CVE-2020-15824, CVE-2020-29582
log4j-slf4j-impl-2.17.0.jar (pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.17.0, cpe:2.3:a:apache:log4j:2.17.0:*:*:*:*:*:*:*) : CVE-2021-44832

See the dependency-check report for more details.
`

[eix128]

I tried latest chronicle wire but problem still appears
chronicle-wire-2.22ea15-SNAPSHOT.jar (pkg:maven/net.openhft/chronicle-wire@2.22ea15-SNAPSHOT, cpe:2.3:a:wire:wire:2.22.ea15:snapshot:*:*:*:*:*:*) : CVE-2018-8909, CVE-2020-15258, CVE-2020-27853, CVE-2021-21301, CVE-2021-32665, CVE-2021-32666, CVE-2021-32755, CVE-2021-41093

[JerryShea]

@eix128 I don't understand what the problem is - can you advise what the security vulnerabilities are please?

[eix128]

you can checkout the problem yourself for latest version
https://jeremylong.github.io/DependencyCheck/dependency-check-maven/

[JerryShea]

@eix128 this is a false positive - jeremylong/DependencyCheck#5024

[eix128]

@JerryShea
intelij gives alert on dependency

    <!-- https://mvnrepository.com/artifact/net.openhft/chronicle-logger-log4j-2 -->
    <dependency>
        <groupId>net.openhft</groupId>
        <artifactId>chronicle-logger-log4j-2</artifactId>
        <version>4.22ea3-SNAPSHOT</version>
    </dependency>

https://devhub.checkmarx.com/cve-details/CVE-2021-44832/?utm_source=jetbrains&utm_medium=referral&utm_campaign=idea

[JerryShea]

I don't think you will see this in the latest chronicle-logger (2.24ea2) - when I check dependencies on that I see that log4j2 is at 2.17.1