search

Chiencc / Spring5-Login_Prioritize-Sample

0 stars 0 forks source link

spring-security-oauth2-jose-5.0.6.RELEASE.jar: 1 vulnerabilities (highest severity is: 9.8) #130

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - spring-security-oauth2-jose-5.0.6.RELEASE.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/nimbusds/nimbus-jose-jwt/5.11/nimbus-jose-jwt-5.11.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-security-oauth2-jose version) Remediation Available
CVE-2019-17195 High 9.8 nimbus-jose-jwt-5.11.jar Transitive 5.2.2.RELEASE ❌

Details

CVE-2019-17195 ### Vulnerable Library - nimbus-jose-jwt-5.11.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/nimbusds/nimbus-jose-jwt/5.11/nimbus-jose-jwt-5.11.jar

Dependency Hierarchy: - spring-security-oauth2-jose-5.0.6.RELEASE.jar (Root Library) - :x: **nimbus-jose-jwt-5.11.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Publish Date: 2019-10-15

URL: CVE-2019-17195

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195

Release Date: 2019-10-15

Fix Resolution (com.nimbusds:nimbus-jose-jwt): 7.8.1

Direct dependency fix Resolution (org.springframework.security:spring-security-oauth2-jose): 5.2.2.RELEASE

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)