mend-for-github-com[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
CVE-2021-29479 - Medium Severity Vulnerability
The core HTTP and composition mechanisms of Ratpack
Library home page: http://www.ratpack.io
Path to dependency file: /dd-java-agent/instrumentation/ratpack-1.5/ratpack-1.5.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/io.ratpack/ratpack-core/1.5.0/ac823d7c4a1ec916be3b42e43369b95658ef14be/ratpack-core-1.5.0.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.ratpack/ratpack-core/1.5.0/ac823d7c4a1ec916be3b42e43369b95658ef14be/ratpack-core-1.5.0.jar
Dependency Hierarchy: - :x: **ratpack-core-1.5.0.jar** (Vulnerable Library)
Found in HEAD commit: 2819174635979a19573ec0ce8e3e2b63a3848079
Found in base branch: master
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.
Publish Date: 2021-06-29
URL: CVE-2021-29479
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q
Release Date: 2021-06-29
Fix Resolution: 1.9.0-rc-1
:rescue_worker_helmet: Automatic Remediation is available for this issue