search

aayant-mend / onboardtraining

0 stars 0 forks source link

spring-boot-starter-web-2.1.3.RELEASE.jar: 32 vulnerabilities (highest severity is: 9.8) #7

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - spring-boot-starter-web-2.1.3.RELEASE.jar

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.hibernate.validator/hibernate-validator/6.0.14.Final/c424524aa7718c564d9199ac5892b05901cabae6/hibernate-validator-6.0.14.Final.jar

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-web version) Remediation Available
CVE-2016-1000027 High 9.8 spring-web-5.1.5.RELEASE.jar Transitive 2.1.15.RELEASE ✅
CVE-2022-1471 High 9.8 snakeyaml-1.23.jar Transitive N/A* ❌
CVE-2019-0232 High 8.1 tomcat-embed-core-9.0.16.jar Transitive 2.1.5.RELEASE ✅
CVE-2017-18640 High 7.5 snakeyaml-1.23.jar Transitive 2.3.0.RELEASE ✅
CVE-2022-25857 High 7.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2020-5398 High 7.5 spring-web-5.1.5.RELEASE.jar Transitive 2.1.12.RELEASE ✅
CVE-2019-10072 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.1.6.RELEASE ✅
CVE-2019-17563 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.1.12.RELEASE ✅
CVE-2020-11996 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.1.15.RELEASE ✅
CVE-2020-13934 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.1.16.RELEASE ✅
CVE-2020-13935 High 7.5 tomcat-embed-websocket-9.0.16.jar Transitive 2.1.16.RELEASE ✅
CVE-2021-25122 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.3.9.RELEASE ✅
CVE-2021-41079 High 7.5 tomcat-embed-core-9.0.16.jar Transitive 2.3.10.RELEASE ✅
CVE-2022-42252 High 7.5 tomcat-embed-core-9.0.16.jar Transitive N/A* ❌
CVE-2021-25329 High 7.0 tomcat-embed-core-9.0.16.jar Transitive 2.3.9.RELEASE ✅
CVE-2019-12418 High 7.0 tomcat-embed-core-9.0.16.jar Transitive 2.1.11.RELEASE ✅
CVE-2020-9484 High 7.0 tomcat-embed-core-9.0.16.jar Transitive 2.1.15.RELEASE ✅
CVE-2022-38752 Medium 6.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2022-38751 Medium 6.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2022-38749 Medium 6.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2022-41854 Medium 6.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2020-5421 Medium 6.5 spring-web-5.1.5.RELEASE.jar Transitive 2.1.17.RELEASE ✅
CVE-2019-0221 Medium 6.1 tomcat-embed-core-9.0.16.jar Transitive 2.1.5.RELEASE ✅
CVE-2019-10219 Medium 6.1 hibernate-validator-6.0.14.Final.jar Transitive 2.1.10.RELEASE ✅
CVE-2021-24122 Medium 5.9 tomcat-embed-core-9.0.16.jar Transitive 2.2.12.RELEASE ✅
CVE-2022-38750 Medium 5.5 snakeyaml-1.23.jar Transitive 2.6.9 ✅
CVE-2021-33037 Medium 5.3 tomcat-embed-core-9.0.16.jar Transitive 2.4.8 ✅
CVE-2020-10693 Medium 5.3 hibernate-validator-6.0.14.Final.jar Transitive 2.1.15.RELEASE ✅
CVE-2020-1935 Medium 4.8 tomcat-embed-core-9.0.16.jar Transitive 2.1.13.RELEASE ✅
CVE-2020-13943 Medium 4.3 tomcat-embed-core-9.0.16.jar Transitive 2.1.17.RELEASE ✅
CVE-2021-22096 Medium 4.3 detected in multiple dependencies Transitive 2.4.0 ✅
CVE-2021-43980 Low 3.7 tomcat-embed-core-9.0.16.jar Transitive 2.5.13 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (20 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2016-1000027 ### Vulnerable Library - spring-web-5.1.5.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.1.5.RELEASE/c37c4363be4ad6c5f67e3f9f020497e2d599e325/spring-web-5.1.5.RELEASE.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - :x: **spring-web-5.1.5.RELEASE.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-01-02

Fix Resolution (org.springframework:spring-web): 5.1.16.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.15.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2022-1471 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.

Publish Date: 2022-12-01

URL: CVE-2022-1471

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2019-0232 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

Publish Date: 2019-04-15

URL: CVE-2019-0232

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0232

Release Date: 2019-04-15

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.19

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.5.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2017-18640 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Publish Date: 2019-12-12

URL: CVE-2017-18640

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640

Release Date: 2019-12-12

Fix Resolution (org.yaml:snakeyaml): 1.26

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.0.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2022-25857 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Publish Date: 2022-08-30

URL: CVE-2022-25857

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857

Release Date: 2022-08-30

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9

In order to enable automatic remediation, please create workflow rules

CVE-2020-5398 ### Vulnerable Library - spring-web-5.1.5.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.1.5.RELEASE/c37c4363be4ad6c5f67e3f9f020497e2d599e325/spring-web-5.1.5.RELEASE.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - :x: **spring-web-5.1.5.RELEASE.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Publish Date: 2020-01-17

URL: CVE-2020-5398

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2020-5398

Release Date: 2020-01-17

Fix Resolution (org.springframework:spring-web): 5.1.13.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.12.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2019-10072 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Publish Date: 2019-06-21

URL: CVE-2019-10072

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41

Release Date: 2019-06-21

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.20

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.6.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2019-17563 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Publish Date: 2019-12-23

URL: CVE-2019-17563

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17563

Release Date: 2019-12-23

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.30

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.12.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-11996 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Publish Date: 2020-06-26

URL: CVE-2020-11996

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E,http://tomcat.apache.org/security-10.html

Release Date: 2020-06-26

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.36

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.15.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-13934 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13934

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.37

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.16.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-13935 ### Vulnerable Library - tomcat-embed-websocket-9.0.16.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-websocket/9.0.16/f5eac487823c68f5d20742a99df1d94350c24d21/tomcat-embed-websocket-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-websocket-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13935

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-websocket): 9.0.37

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.16.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2021-25122 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Publish Date: 2021-03-01

URL: CVE-2021-25122

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.9.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2021-41079 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Publish Date: 2021-09-16

URL: CVE-2021-41079

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-10.html

Release Date: 2021-09-16

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.44

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.10.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2022-42252 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Publish Date: 2022-11-01

URL: CVE-2022-42252

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-p22x-g9px-3945

Release Date: 2022-11-01

Fix Resolution: org.apache.tomcat:tomcat:8.5.83,9.0.68,10.0.27,10.1.1

CVE-2021-25329 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Publish Date: 2021-03-01

URL: CVE-2021-25329

### CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.9.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2019-12418 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Publish Date: 2019-12-23

URL: CVE-2019-12418

### CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418

Release Date: 2019-12-23

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.29

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.11.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-9484 ### Vulnerable Library - tomcat-embed-core-9.0.16.jar

Core Tomcat implementation

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.16/d7069e3d0f760035b26b68b7b6af5eaa0c1862f/tomcat-embed-core-9.0.16.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.3.RELEASE.jar - :x: **tomcat-embed-core-9.0.16.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Publish Date: 2020-05-20

URL: CVE-2020-9484

### CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484

Release Date: 2020-05-20

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.35

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.15.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2022-38752 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Publish Date: 2022-09-05

URL: CVE-2022-38752

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-9w3m-gqgf-c4p9

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.32

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9

In order to enable automatic remediation, please create workflow rules

CVE-2022-38751 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38751

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9

In order to enable automatic remediation, please create workflow rules

CVE-2022-38749 ### Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /Java/Gradle/kotlin-build-1/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar

Dependency Hierarchy: - spring-boot-starter-web-2.1.3.RELEASE.jar (Root Library) - spring-boot-starter-2.1.3.RELEASE.jar - :x: **snakeyaml-1.23.jar** (Vulnerable Library)

Found in HEAD commit: 4839f6588961e746880b27503fdce27cafb1e42e

Found in base branch: main

### Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38749

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules

mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 2 years ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.