Xml-apis-ext same hash multiple version other risk level

post by frank.bos on Jan 28, 2022

Our developer used xml-apis-ext Version: 1.3.04 which has a Apache license.

However NexusIQ flags V2.5.0 which has no license.

Hash is the same:

sha1sum xml-apis-ext*

41a8b86b358e87f3f13cf46069721719105aff66 xml-apis-ext-2.5.0.jar
41a8b86b358e87f3f13cf46069721719105aff66 xml-apis-ext.jar (1.3.04 version with license in it!)

url maven:

https://mvnrepository.com/artifact/org.clojars.pallix/xml-apis-ext/2.5.0

https://mvnrepository.com/artifact/xml-apis/xml-apis-ext/1.3.04

How to solve this?

Our company will fail the build on License-none (which is 2.5.0)

post by rseddon on Jan 31, 2022

Hi Frank,

Please raise support questions relating to Nexus IQ Server at https://support.sonatype.com, we’ll be happy to help you there!

Regards,

Rich

post by frank.bos on Jan 31, 2022

done and thanks Rich