The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.
Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.
See the documentation for more details on correct cluster administration.
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
Mend Note: For 2.13.4.x, the vulnerability is fixed in 2.13.4.1. A micro-patch was added in 2.13.4.2 to address issues for Gradle users.
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-37137
### Vulnerable Library - netty-codec-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-37136
### Vulnerable Library - netty-codec-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-11612
### Vulnerable Library - netty-codec-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2020-0408
### Vulnerable Library - netty-handler-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
An issue was found in all versions of io.netty:netty-all. Host verification in Netty is disabled by default. This can lead to MITM attack in which an attacker can forge valid SSL/TLS certificates for a different hostname in order to intercept traffic that doesn’t intend for him. This is an issue because the certificate is not matched with the host.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-34462
### Vulnerable Library - netty-handler-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-21290
### Vulnerable Library - netty-handler-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-47535
### Vulnerable Library - netty-common-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Mend Note: Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-24823
### Vulnerable Library - netty-common-4.1.45.Final.jar
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-44981
### Vulnerable Library - zookeeper-3.5.7.jarZooKeeper server
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/zookeeper/zookeeper/3.5.7/zookeeper-3.5.7.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - :x: **zookeeper-3.5.7.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.
Publish Date: 2023-10-11
URL: CVE-2023-44981
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b
Release Date: 2023-10-11
Fix Resolution (org.apache.zookeeper:zookeeper): 3.7.2
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-42004
### Vulnerable Library - jackson-databind-2.10.0.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - curator-x-discovery-4.3.0.jar - :x: **jackson-databind-2.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsIn FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Publish Date: 2022-10-02
URL: CVE-2022-42004
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.7.1
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-42003
### Vulnerable Library - jackson-databind-2.10.0.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - curator-x-discovery-4.3.0.jar - :x: **jackson-databind-2.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsIn FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Mend Note: For 2.13.4.x, the vulnerability is fixed in 2.13.4.1. A micro-patch was added in 2.13.4.2 to address issues for Gradle users.
Publish Date: 2022-10-02
URL: CVE-2022-42003
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-jjjh-jjxp-wpff
Release Date: 2022-10-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.7.1
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-46877
### Vulnerable Library - jackson-databind-2.10.0.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - curator-x-discovery-4.3.0.jar - :x: **jackson-databind-2.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability Detailsjackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Publish Date: 2023-03-18
URL: CVE-2021-46877
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2021-46877
Release Date: 2023-03-18
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-37137
### Vulnerable Library - netty-codec-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.45.Final/netty-codec-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - netty-handler-4.1.45.Final.jar - :x: **netty-codec-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsThe Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Publish Date: 2021-10-19
URL: CVE-2021-37137
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-9vjp-v76f-g363
Release Date: 2021-10-19
Fix Resolution (io.netty:netty-codec): 4.1.68.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-37136
### Vulnerable Library - netty-codec-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.45.Final/netty-codec-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - netty-handler-4.1.45.Final.jar - :x: **netty-codec-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsThe Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Publish Date: 2021-10-19
URL: CVE-2021-37136
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
Release Date: 2021-10-19
Fix Resolution (io.netty:netty-codec): 4.1.68.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-36518
### Vulnerable Library - jackson-databind-2.10.0.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - curator-x-discovery-4.3.0.jar - :x: **jackson-databind-2.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability Detailsjackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.
Publish Date: 2022-03-11
URL: CVE-2020-36518
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-03-11
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6.1
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-25649
### Vulnerable Library - jackson-databind-2.10.0.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - curator-x-discovery-4.3.0.jar - :x: **jackson-databind-2.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsA flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Publish Date: 2020-12-03
URL: CVE-2020-25649
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-12-03
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.10.5.1
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-11612
### Vulnerable Library - netty-codec-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.45.Final/netty-codec-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - netty-handler-4.1.45.Final.jar - :x: **netty-codec-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsThe ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Publish Date: 2020-04-07
URL: CVE-2020-11612
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://netty.io/news/2020/02/28/4-1-46-Final.html
Release Date: 2020-04-07
Fix Resolution (io.netty:netty-codec): 4.1.46.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2020-0408
### Vulnerable Library - netty-handler-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.45.Final/netty-handler-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - :x: **netty-handler-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsAn issue was found in all versions of io.netty:netty-all. Host verification in Netty is disabled by default. This can lead to MITM attack in which an attacker can forge valid SSL/TLS certificates for a different hostname in order to intercept traffic that doesn’t intend for him. This is an issue because the certificate is not matched with the host.
Publish Date: 2020-06-22
URL: WS-2020-0408
### CVSS 3 Score Details (7.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2020-0408
Release Date: 2020-06-22
Fix Resolution (io.netty:netty-handler): 4.1.69.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-34462
### Vulnerable Library - netty-handler-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.45.Final/netty-handler-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - :x: **netty-handler-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
Publish Date: 2023-06-22
URL: CVE-2023-34462
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-6mjq-h674-j845
Release Date: 2023-06-22
Fix Resolution (io.netty:netty-handler): 4.1.94.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-21290
### Vulnerable Library - netty-handler-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.45.Final/netty-handler-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - :x: **netty-handler-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsNetty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
Publish Date: 2021-02-08
URL: CVE-2021-21290
### CVSS 3 Score Details (6.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2
Release Date: 2021-02-08
Fix Resolution (io.netty:netty-handler): 4.1.59.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-47535
### Vulnerable Library - netty-common-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.45.Final/netty-common-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - netty-handler-4.1.45.Final.jar - :x: **netty-common-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Publish Date: 2024-11-12
URL: CVE-2024-47535
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-xq3w-v528-46rv
Release Date: 2024-11-12
Fix Resolution (io.netty:netty-common): 4.1.115.Final
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-2976
### Vulnerable Library - guava-28.2-jre.jarGuava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: https://github.com/google/guava
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/28.2-jre/guava-28.2-jre.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - :x: **guava-28.2-jre.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsUse of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. Mend Note: Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Publish Date: 2023-06-14
URL: CVE-2023-2976
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-7g45-4rm6-3mm3
Release Date: 2023-06-14
Fix Resolution (com.google.guava:guava): 32.0.1-android
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-24823
### Vulnerable Library - netty-common-4.1.45.Final.jarNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.45.Final/netty-common-4.1.45.Final.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - zookeeper-3.5.7.jar - netty-handler-4.1.45.Final.jar - :x: **netty-common-4.1.45.Final.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsNetty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
Publish Date: 2022-05-06
URL: CVE-2022-24823
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24823
Release Date: 2022-05-06
Fix Resolution: io.netty:netty-all;io.netty:netty-common - 4.1.77.Final
CVE-2020-8908
### Vulnerable Library - guava-28.2-jre.jarGuava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: https://github.com/google/guava
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/28.2-jre/guava-28.2-jre.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - :x: **guava-28.2-jre.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsA temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Publish Date: 2020-12-10
URL: CVE-2020-8908
### CVSS 3 Score Details (3.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-8908
Release Date: 2020-12-10
Fix Resolution (com.google.guava:guava): 30.0-android
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.11.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-22371
### Vulnerable Library - camel-support-3.4.3.jarThe Camel Support
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/camel/camel-support/3.4.3/camel-support-3.4.3.jar
Dependency Hierarchy: - camel-zookeeper-3.4.3.jar (Root Library) - :x: **camel-support-3.4.3.jar** (Vulnerable Library)
Found in HEAD commit: 9487a0aa1c6c7a58bb54ddefc278b5919988bab2
Found in base branch: master
### Vulnerability DetailsExposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Publish Date: 2024-02-26
URL: CVE-2024-22371
### CVSS 3 Score Details (2.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://camel.apache.org/security/CVE-2024-22371.html
Release Date: 2024-02-26
Fix Resolution (org.apache.camel:camel-support): 3.21.4
Direct dependency fix Resolution (org.apache.camel:camel-zookeeper): 3.21.4
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.