mend-for-github-com[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Path to dependency file: /openmetadata-service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-servlets/9.4.51.v20230217/jetty-servlets-9.4.51.v20230217.jar
Found in HEAD commit: 0d43a8050e6c73014cff9be7dec96a81296f3061
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-36479
### Vulnerable Library - jetty-servlets-9.4.51.v20230217.jarUtility Servlets from Jetty
Library home page: https://eclipse.org/jetty
Path to dependency file: /openmetadata-service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-servlets/9.4.51.v20230217/jetty-servlets-9.4.51.v20230217.jar
Dependency Hierarchy: - dropwizard-assets-2.1.6.jar (Root Library) - dropwizard-core-2.1.6.jar - dropwizard-jetty-2.1.6.jar - :x: **jetty-servlets-9.4.51.v20230217.jar** (Vulnerable Library)
Found in HEAD commit: 0d43a8050e6c73014cff9be7dec96a81296f3061
Found in base branch: main
### Vulnerability DetailsEclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Publish Date: 2023-09-15
URL: CVE-2023-36479
### CVSS 3 Score Details (4.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j
Release Date: 2023-09-15
Fix Resolution (org.eclipse.jetty:jetty-servlets): 9.4.52.v20230823
Direct dependency fix Resolution (io.dropwizard:dropwizard-assets): 3.0.0
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules