DOCSEARCHbyAlgolia
Submit Docs

Apache Commons Configuration

repository·master·Indexed 42 days ago

https://github.com/apache/commons-configuration

A Java library providing a generic interface for reading configuration data from multiple sources. Supports Java 8 or higher and is available as version 2.15.1 via Maven.

Tokens
707
Snippets
4
Records
5
Agent score
3%

What's inside Apache Commons Configuration

  2. Understand VEX (Vulnerability Exploitability eXchange) for Apache Commons Configuration

    master

    Apache Commons Configuration publishes an experimental VEX document to provide information regarding the exploitability of known vulnerabilities within its dependencies.

    Important Security Context: Because Apache Commons libraries do not bundle their dependencies, a vulnerability in a dependency is only considered exploitable in your application if:

    1. The vulnerable dependency is included in your consuming project.
    2. Apache Commons Configuration is explicitly listed as affected by that vulnerability.

    Limitations of the VEX document:

    • The document is experimental and provided as-is.
    • The absence of a vulnerability entry does not guarantee that Configuration is unaffected.
    • If a version of Configuration is not listed under the affects section, it may still be affected.
    • Currently, only the latest major version of Configuration is assessed for vulnerabilities.
    • The analysis field in the VEX file uses Markdown formatting.
    https://raw.githubusercontent.com/apache/commons-configuration/refs/heads/master/src/conf/security/VEX.cyclonedx.xml

  3. Install Apache Commons Configuration 2 via Maven

    master

    To use Apache Commons Configuration in your Java project, add the following dependency to your pom.xml file. This pulls the library from the central Maven repository.

    <dependency>
  <groupId>org.apache.commons</groupId>
  <artifactId>commons-configuration2</artifactId>
  <version>2.15.1</version>
</dependency>

  5. Locate SBOMs for Apache Commons Configuration

    master

    Starting from version 2.9.0, Apache Commons Configuration publishes Software Bill of Materials (SBOM) documents in both XML and JSON formats to Maven Central. These documents allow you to analyze the software supply chain and manage dependency risks by listing all required and optional dependencies using standard Maven coordinates.

    To find the SBOMs, use the following Maven coordinates with the cyclonedx classifier:

    Group ID: org.apache.commons
Artifact ID: commons-configuration2
Classifier: cyclonedx
Type: xml or json