search

KouShenhai / KCloud-Platform-IoT

KCloud-Platform-IoT（阻塞式）（老寇IoT云平台）是一个企业级微服务架构的IoT云平台。采用DDD(领域驱动设计)思想，基于Spring Boot 3.4.0、Spring Cloud 2024.0.0、Spring Cloud Alibaba 2023.0.1.2 最新版本开发的云服务多租户IoT平台，家人们，点个star！拜托啦~
https://koushenhai.github.io/KCloud-Platform-IoT
Apache License 2.0
458 stars 118 forks source link

easyexcel-core-3.3.4.jar: 5 vulnerabilities (highest severity is: 7.5) - autoclosed #1952

Closed mend-bolt-for-github[bot] closed 3 months ago

mend-bolt-for-github[bot] commented 3 months ago
Vulnerable Library - easyexcel-core-3.3.4.jar

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-app/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (easyexcel-core version) Remediation Possible**
CVE-2021-36090 High 7.5 commons-compress-1.19.jar Transitive N/A* ❌
CVE-2021-35517 High 7.5 commons-compress-1.19.jar Transitive N/A* ❌
CVE-2021-35516 High 7.5 commons-compress-1.19.jar Transitive N/A* ❌
CVE-2021-35515 High 7.5 commons-compress-1.19.jar Transitive N/A* ❌
CVE-2024-25710 Medium 5.5 commons-compress-1.19.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-36090 ### Vulnerable Library - commons-compress-1.19.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-client/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Dependency Hierarchy: - easyexcel-core-3.3.4.jar (Root Library) - poi-ooxml-4.1.2.jar - :x: **commons-compress-1.19.jar** (Vulnerable Library)

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Found in base branch: master

### Vulnerability Details

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Publish Date: 2021-07-13

URL: CVE-2021-36090

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-35517 ### Vulnerable Library - commons-compress-1.19.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-client/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Dependency Hierarchy: - easyexcel-core-3.3.4.jar (Root Library) - poi-ooxml-4.1.2.jar - :x: **commons-compress-1.19.jar** (Vulnerable Library)

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Found in base branch: master

### Vulnerability Details

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Publish Date: 2021-07-13

URL: CVE-2021-35517

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-35516 ### Vulnerable Library - commons-compress-1.19.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-client/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Dependency Hierarchy: - easyexcel-core-3.3.4.jar (Root Library) - poi-ooxml-4.1.2.jar - :x: **commons-compress-1.19.jar** (Vulnerable Library)

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Found in base branch: master

### Vulnerability Details

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Publish Date: 2021-07-13

URL: CVE-2021-35516

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-35515 ### Vulnerable Library - commons-compress-1.19.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-client/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Dependency Hierarchy: - easyexcel-core-3.3.4.jar (Root Library) - poi-ooxml-4.1.2.jar - :x: **commons-compress-1.19.jar** (Vulnerable Library)

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Found in base branch: master

### Vulnerability Details

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Publish Date: 2021-07-13

URL: CVE-2021-35515

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-25710 ### Vulnerable Library - commons-compress-1.19.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /laokou-service/laokou-admin/laokou-admin-client/pom.xml

Path to vulnerable library: /laokou-service/laokou-admin/laokou-admin-client/pom.xml,/laokou-service/laokou-admin/laokou-admin-infrastructure/pom.xml,/laokou-service/laokou-admin/laokou-admin-adapter/pom.xml,/laokou-service/laokou-admin/laokou-admin-app/pom.xml,/laokou-service/laokou-admin/laokou-admin-start/pom.xml

Dependency Hierarchy: - easyexcel-core-3.3.4.jar (Root Library) - poi-ooxml-4.1.2.jar - :x: **commons-compress-1.19.jar** (Vulnerable Library)

Found in HEAD commit: ef652fd114447a7d5df0fb773f0b2b572fa96dc0

Found in base branch: master

### Vulnerability Details

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Publish Date: 2024-02-19

URL: CVE-2024-25710

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-25710

Release Date: 2024-02-19

Fix Resolution: org.apache.commons:commons-compress:1.26.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 3 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.