title: CVE-2010-1807 vulnerablity (from android-json) in Spring Boot 1.5.3
body: <p>When running OWASP dependency check I am getting following issue reported (vulnerable dependency)</p>
  
  <pre><code>CWE: CVE-2010-1807  
  CWE-20 Improper Input Validation    
  Severity (CVSS): High (9.3) 
  Dependency: android-json-0.0.20131108.vaadin1.jar
  </code></pre>
  
  <p>I am using Spring Boot 1.5.3.
  Doing <code>gradlew dependencies</code> I see that <code>android-json</code> is indeed dependency of Spring Boot</p>
  
  <pre><code>+--- org.springframework.boot:spring-boot-configuration-processor: -&gt; 1.5.3.RELEASE
  |    \--- com.vaadin.external.google:android-json:0.0.20131108.vaadin1
  </code></pre>
  
  <p>How to check if this is false-positive or valid issue?</p>
  
  <p>edit: this dependency is not used in runtime. it is used only in tests. </p>