Maven build fail - Tika 2.4.1 #1460

Anshuman0106 · 2022-07-18T23:22:09Z

Anshuman0106
Jul 18, 2022

I'm trying to install Tika 2.4.1 on a RHEL machine but getting below error.
Is there any easy way to skip the dependency auditing at compile time? Or a way to update that library to resolve the security issues? Though I tried a command "mvn clean install -Dossindex.fail=false" but did not help.

[ERROR] Failed to execute goal org.sonatype.ossindex.maven:ossindex-maven-plugin:3.2.0:audit (audit-dependencies) on project tika-fetcher-az-blob: Detected 1 vulnerable components:
[ERROR] com.azure:azure-storage-blob:jar:12.17.1:compile; https://ossindex.sonatype.org/component/pkg:maven/com.azure/azure-storage-blob@12.17.1?utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
[ERROR] * [CVE-2022-30187] CWE-200: Information Exposure (4.7); https://ossindex.sonatype.org/vulnerability/CVE-2022-30187?component-type=maven&component-name=com.azure%2Fazure-storage-blob&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
[ERROR]
[ERROR] Excluded coordinates:
[ERROR] - io.netty:netty-handler:4.1.77.Final
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn -rf :tika-fetcher-az-blob

Answered by dadoonet

Jul 28, 2022

I did not realize initially that your question is related to Tika and not FSCrawler.
Here we support only FSCrawler. Please ask on the Tika dev mailing list for support instead.

View full answer

dadoonet · 2022-07-19T08:02:55Z

dadoonet
Jul 19, 2022
Maintainer

Could you try again, because it's supposed to work that way with:

mvn clean install -Dossindex.fail=false

And could you provide the full logs of the module? Please format the code using markdown or the <> icon.

1 reply

Anshuman0106 Jul 20, 2022
Author

This morning I rerun below command and then I found that I got build failure at Apache Tika transcribe aws 2.4.1 module due to vulnerability detected and below command is not helping me at all to proceed by marking vulnerability as warning only.
mvn clean install -DskipTests=true -Dossindex.fail=false
Below is full log of failed module.

[INFO] ----------------< org.apache.tika:tika-transcribe-aws >-----------------
[INFO] Building Apache Tika transcribe aws 2.4.1                        [46/97]
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO]
[INFO] --- maven-clean-plugin:3.2.0:clean (default-clean) @ tika-transcribe-aws ---
[INFO]
[INFO] --- ossindex-maven-plugin:3.2.0:audit (audit-dependencies) @ tika-transcribe-aws ---
[INFO] Checking for vulnerabilities; 26 artifacts
[INFO] Exclude coordinates: [com.ibm.icu:icu4j:62.2, com.google.guava:guava:31.1-jre, org.apache.lucene:lucene-queryparser:4.0.0, com.drewnoakes:metadata-extractor:2.18.0, io.netty:netty-handler:4.1.77.Final, log4j:log4j:1.2.17, xerces:xercesImpl:2.12.2, com.h2database:h2:2.1.212, commons-dbcp:commons-dbcp:1.4]
[INFO] Exclude vulnerability identifiers: []
[INFO] CVSS-score threshold: 0.0
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Tika 2.4.1:
[INFO]
[INFO] Apache Tika parent ................................. SUCCESS [  2.639 s]
[INFO] Apache Tika BOM .................................... SUCCESS [  0.156 s]
[INFO] Apache Tika core ................................... SUCCESS [ 25.272 s]
[INFO] Apache Tika serialization .......................... SUCCESS [  2.365 s]
[INFO] Apache Tika parser modules ......................... SUCCESS [  0.122 s]
[INFO] Apache Tika standard parser modules and package .... SUCCESS [  0.306 s]
[INFO] Apache Tika standard parser modules ................ SUCCESS [  0.078 s]
[INFO] Apache Tika html commons ........................... SUCCESS [  0.733 s]
[INFO] Apache Tika jdbc parser commons .................... SUCCESS [  0.792 s]
[INFO] Apache Tika digest commons ......................... SUCCESS [  1.100 s]
[INFO] Apache Tika mail commons ........................... SUCCESS [  0.458 s]
[INFO] Apache Tika XMP commons ............................ SUCCESS [  0.827 s]
[INFO] Apache Tika ZIP commons ............................ SUCCESS [  1.000 s]
[INFO] Apache Tika image parser module .................... SUCCESS [  1.721 s]
[INFO] Apache Tika OCR parser module ...................... SUCCESS [  1.425 s]
[INFO] Apache Tika audiovideo parser module ............... SUCCESS [  1.833 s]
[INFO] Apache Tika text parser module ..................... SUCCESS [  2.270 s]
[INFO] Apache Tika code parser module ..................... SUCCESS [  1.757 s]
[INFO] Apache Tika html parser module ..................... SUCCESS [  1.477 s]
[INFO] Apache Tika font parser module ..................... SUCCESS [  0.537 s]
[INFO] Apache Tika XML parser module ...................... SUCCESS [  0.688 s]
[INFO] Apache Tika Microsoft parser module ................ SUCCESS [ 11.273 s]
[INFO] Apache Tika package parser module .................. SUCCESS [  1.020 s]
[INFO] Apache Tika PDF parser module ...................... SUCCESS [  2.974 s]
[INFO] Apache Tika Apple parser module .................... SUCCESS [  1.135 s]
[INFO] Apache Tika cad parser module ...................... SUCCESS [  1.424 s]
[INFO] Apache Tika mail parser module ..................... SUCCESS [  1.090 s]
[INFO] Apache Tika miscellaneous office format parser module SUCCESS [  2.324 s]
[INFO] Apache Tika news parser module ..................... SUCCESS [  0.692 s]
[INFO] Apache Tika crypto parser module ................... SUCCESS [  0.776 s]
[INFO] Apache Tika WARC parser module ..................... SUCCESS [  0.535 s]
[INFO] Apache Tika standard parser package ................ SUCCESS [  4.360 s]
[INFO] Apache Tika extended parsers ....................... SUCCESS [  0.071 s]
[INFO] Apache Tika sqlite3 parser module .................. SUCCESS [  0.456 s]
[INFO] Apache Tika scientific parser module ............... SUCCESS [  2.379 s]
[INFO] Apache Tika sqlite3 parser package ................. SUCCESS [  2.114 s]
[INFO] Apache Tika scientific parser package .............. SUCCESS [  4.484 s]
[INFO] Apache Tika extended parser integration tests ...... SUCCESS [  0.744 s]
[INFO] Apache Tika machine learning (ml) parsers .......... SUCCESS [  0.061 s]
[INFO] Apache Tika natural language process module ........ SUCCESS [  2.520 s]
[INFO] Apache Tika natural language processing package .... SUCCESS [  3.639 s]
[INFO] Apache Tika age recogniser ......................... SUCCESS [ 35.562 s]
[INFO] Apache Tika advanced media module .................. SUCCESS [  0.839 s]
[INFO] Apache Tika advanced media package ................. SUCCESS [  0.617 s]
[INFO] Apache Tika Deep Learning (powered by DL4J) ........ SUCCESS [ 26.500 s]
[INFO] Apache Tika transcribe aws ......................... FAILURE [  0.021 s]
[INFO] Apache Tika bundles module ......................... SKIPPED
[INFO] Apache Tika OSGi standard bundle ................... SKIPPED
[INFO] Apache Tika XMP .................................... SKIPPED
[INFO] Apache Tika batch .................................. SKIPPED
[INFO] Apache Tika language detection ..................... SKIPPED
[INFO] Apache Tika langdetect test commons ................ SKIPPED
[INFO] Apache Tika langdetect (legacy builtin) ............ SKIPPED
[INFO] Apache Tika Lingo24 langdetect ..................... SKIPPED
[INFO] Apache Tika Optimaize langdetect ................... SKIPPED
[INFO] Apache Tika MIT Lincoln Labs langdetect ............ SKIPPED
[INFO] Apache Tika OpenNLP langdetect ..................... SKIPPED
[INFO] Apache Tika pipes .................................. SKIPPED
[INFO] Apache Tika emitters ............................... SKIPPED
[INFO] Apache Tika filesystem emitter ..................... SKIPPED
[INFO] Apache Tika application ............................ SKIPPED
[INFO] Apache Tika httpclient commons ..................... SKIPPED
[INFO] Apache Tika fetchers ............................... SKIPPED
[INFO] Apache Tika http fetcher ........................... SKIPPED
[INFO] Apache Tika S3 fetcher ............................. SKIPPED
[INFO] Apache Tika Google Cloud Storage fetcher ........... SKIPPED
[INFO] Apache Tika Azure Blob fetcher ..................... SKIPPED
[INFO] Apache Tika S3 emitter ............................. SKIPPED
[INFO] Apache Tika Apache Solr emitter .................... SKIPPED
[INFO] Apache Tika OpenSearch emitter ..................... SKIPPED
[INFO] Apache Tika GCS emitter ............................ SKIPPED
[INFO] Apache Tika Azure blob ............................. SKIPPED
[INFO] Apache Tika Pipes Iterators ........................ SKIPPED
[INFO] Apache Tika Pipes Iterator - CSV ................... SKIPPED
[INFO] Apache Tika Pipes Iterator - JDBC .................. SKIPPED
[INFO] Apache Tika Pipes Iterator - S3 .................... SKIPPED
[INFO] Apache Tika Pipes Iterator - Solr .................. SKIPPED
[INFO] Apache Tika Pipes Iterator - Google Cloud Storage .. SKIPPED
[INFO] Apache Tika Pipes Iterator - Azure Blob Storage .... SKIPPED
[INFO] Apache Tika translate .............................. SKIPPED
[INFO] Apache Tika server module .......................... SKIPPED
[INFO] Apache Tika server core ............................ SKIPPED
[INFO] Apache Tika standard server ........................ SKIPPED
[INFO] Apache Tika server client .......................... SKIPPED
[INFO] Apache Tika eval module ............................ SKIPPED
[INFO] Apache Tika eval core .............................. SKIPPED
[INFO] Apache Tika server tika-eval handler ............... SKIPPED
[INFO] Apache Tika integration tests ...................... SKIPPED
[INFO] Apache Tika Apache Solr integration tests .......... SKIPPED
[INFO] Apache Tika OpenSearch integration tests ........... SKIPPED
[INFO] Apache Tika S3 pipes integration tests ............. SKIPPED
[INFO] tika-resource-loading-tests ........................ SKIPPED
[INFO] Apache Tika eval application ....................... SKIPPED
[INFO] Apache Tika fuzzing ................................ SKIPPED
[INFO] Apache Tika examples ............................... SKIPPED
[INFO] Apache Tika Java-7 Components ...................... SKIPPED
[INFO] Apache Tika ........................................ SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  02:36 min
[INFO] Finished at: 2022-07-20T18:02:16-04:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.sonatype.ossindex.maven:ossindex-maven-plugin:3.2.0:audit (audit-dependencies) on project tika-transcribe-aws: Detected 1 vulnerable components:
[ERROR]   com.amazonaws:aws-java-sdk-s3:jar:1.12.237:compile; https://ossindex.sonatype.org/component/pkg:maven/com.amazonaws/aws-java-sdk-s3@1.12.237?utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
[ERROR]     * [CVE-2022-31159] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (7.9); https://ossindex.sonatype.org/vulnerability/CVE-2022-31159?component-type=maven&component-name=com.amazonaws%2Faws-java-sdk-s3&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <args> -rf :tika-transcribe-aws
[ec2-user@avgdxslrd-4f7d tika]$

dadoonet · 2022-07-28T17:57:16Z

dadoonet
Jul 28, 2022
Maintainer

I did not realize initially that your question is related to Tika and not FSCrawler.
Here we support only FSCrawler. Please ask on the Tika dev mailing list for support instead.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Maven build fail - Tika 2.4.1 #1460

{{title}}

Replies: 2 comments 1 reply

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Maven build fail - Tika 2.4.1 #1460

Anshuman0106 Jul 18, 2022

Replies: 2 comments · 1 reply

dadoonet Jul 19, 2022 Maintainer

Anshuman0106 Jul 20, 2022 Author

dadoonet Jul 28, 2022 Maintainer

Anshuman0106
Jul 18, 2022

Replies: 2 comments 1 reply

dadoonet
Jul 19, 2022
Maintainer

Anshuman0106 Jul 20, 2022
Author

dadoonet
Jul 28, 2022
Maintainer