search

amaybaum-dev / spring-cloud-alibaba2

Spring Cloud Alibaba provides a one-stop solution for application development for the distributed solutions of Alibaba middleware.
https://spring.io/projects/spring-cloud-alibaba
Apache License 2.0
0 stars 1 forks source link

seata-server-1.5.0.jar: 9 vulnerabilities (highest severity is: 9.8) reachable - autoclosed #4

Closed dev-mend-for-github-com[bot] closed 1 year ago

dev-mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - seata-server-1.5.0.jar

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.10.6/ant-1.10.6.jar

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (seata-server version) Remediation Available Reachability
CVE-2019-9212 Critical 9.8 hessian-3.3.6.jar Transitive N/A* ❌
WS-2019-0490 High 8.1 jcommander-1.72.jar Transitive N/A* ❌

CVE-2020-11979 High 7.5 ant-1.10.6.jar Transitive 1.6.0 ✅

CVE-2020-15170 High 7.0 apollo-core-1.6.0.jar Transitive 1.6.0 ✅

CVE-2020-1945 Medium 6.3 ant-1.10.6.jar Transitive 1.6.0 ✅

CVE-2019-0201 Medium 5.9 zookeeper-3.4.13.jar Transitive N/A* ❌

CVE-2021-36373 Medium 5.5 ant-1.10.6.jar Transitive 1.6.0 ✅

CVE-2021-36374 Medium 5.5 ant-1.10.6.jar Transitive 1.6.0 ✅

CVE-2020-8908 Low 3.3 guava-27.0.1-jre.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2019-9212 ### Vulnerable Library - hessian-3.3.6.jar

An internal improved version of Hessian powered by Ant Financial.

Library home page: http://github.com/alipay/sofa-hessian

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/alipay/sofa/hessian/3.3.6/hessian-3.3.6.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-discovery-all-1.5.0.jar - seata-discovery-sofa-1.5.0.jar - registry-client-all-5.2.0.jar - :x: **hessian-3.3.6.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Vulnerability Details

** DISPUTED ** SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated.

Publish Date: 2019-02-27

URL: CVE-2019-9212

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9212

Release Date: 2019-02-27

Fix Resolution: 4.0.3

WS-2019-0490 ### Vulnerable Library - jcommander-1.72.jar

Command line parsing

Library home page: http://jcommander.org

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/beust/jcommander/1.72/jcommander-1.72.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - :x: **jcommander-1.72.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Publish Date: 2019-02-19

URL: WS-2019-0490

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-02-19

Fix Resolution: com.beust:jcommander:1.75

CVE-2020-11979 ### Vulnerable Library - ant-1.10.6.jar

master POM

Library home page: http://ant.apache.org/

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.10.6/ant-1.10.6.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-compressor-all-1.5.0.jar - seata-compressor-bzip2-1.5.0.jar - :x: **ant-1.10.6.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.SentinelWebAutoConfiguration (Application) -> org.apache.catalina.connector.Request (Extension) -> org.apache.catalina.realm.MemoryRealm (Extension) -> org.apache.tomcat.util.descriptor.tagplugin.TagPluginParser (Extension) ... -> org.apache.tools.ant.types.XMLCatalog$ExternalResolver (Extension) -> org.apache.tools.ant.util.FileUtils (Extension) -> ❌ org.apache.tools.ant.types.resources.FileResource (Vulnerable Component) ```

### Vulnerability Details

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Publish Date: 2020-10-01

URL: CVE-2020-11979

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://ant.apache.org/security.html

Release Date: 2020-10-01

Fix Resolution (org.apache.ant:ant): 1.10.9

Direct dependency fix Resolution (io.seata:seata-server): 1.6.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-15170 ### Vulnerable Library - apollo-core-1.6.0.jar

Ctrip Configuration Center

Library home page: https://github.com/ctripcorp/apollo

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/ctrip/framework/apollo/apollo-core/1.6.0/apollo-core-1.6.0.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-config-all-1.5.0.jar - seata-config-apollo-1.5.0.jar - apollo-client-1.6.0.jar - :x: **apollo-core-1.6.0.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.datasource.factorybean.ApolloDataSourceFactoryBean (Application) -> com.alibaba.csp.sentinel.datasource.apollo.ApolloDataSource (Extension) -> com.ctrip.framework.apollo.ConfigService (Extension) -> com.ctrip.framework.apollo.build.ApolloInjector (Extension) ... -> com.ctrip.framework.apollo.internals.DefaultInjector$ApolloModule (Extension) -> com.ctrip.framework.apollo.internals.RemoteConfigLongPollService (Extension) -> ❌ com.ctrip.framework.apollo.core.signature.Signature (Vulnerable Component) ```

### Vulnerability Details

apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

Publish Date: 2020-09-10

URL: CVE-2020-15170

### CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: High - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15170

Release Date: 2020-09-10

Fix Resolution (com.ctrip.framework.apollo:apollo-core): 1.8.0

Direct dependency fix Resolution (io.seata:seata-server): 1.6.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-1945 ### Vulnerable Library - ant-1.10.6.jar

master POM

Library home page: http://ant.apache.org/

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.10.6/ant-1.10.6.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-compressor-all-1.5.0.jar - seata-compressor-bzip2-1.5.0.jar - :x: **ant-1.10.6.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.SentinelWebAutoConfiguration (Application) -> org.apache.catalina.connector.Request (Extension) -> org.apache.catalina.authenticator.SpnegoAuthenticator (Extension) -> org.apache.tomcat.util.descriptor.web.WebXmlParser (Extension) ... -> org.apache.tools.ant.types.XMLCatalog$InternalResolver (Extension) -> org.apache.tools.ant.Project (Extension) -> ❌ org.apache.tools.ant.util.FileUtils (Vulnerable Component) ```

### Vulnerability Details

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Publish Date: 2020-05-14

URL: CVE-2020-1945

### CVSS 3 Score Details (6.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://ant.apache.org/security.html

Release Date: 2020-05-14

Fix Resolution (org.apache.ant:ant): 1.10.8

Direct dependency fix Resolution (io.seata:seata-server): 1.6.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2019-0201 ### Vulnerable Library - zookeeper-3.4.13.jar

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/zookeeper/zookeeper/3.4.13/zookeeper-3.4.13.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-config-all-1.5.0.jar - seata-config-zk-1.5.0.jar - zkclient-0.11.jar - :x: **zookeeper-3.4.13.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.datasource.factorybean.ZookeeperDataSourceFactoryBean (Application) -> com.alibaba.csp.sentinel.datasource.zookeeper.ZookeeperDataSource (Extension) -> org.apache.curator.framework.CuratorFrameworkFactory$Builder (Extension) -> org.apache.zookeeper.server.DataTree (Extension) ... -> org.apache.zookeeper.server.quorum.LearnerHandler (Extension) -> org.apache.zookeeper.server.quorum.LeaderZooKeeperServer (Extension) -> ❌ org.apache.zookeeper.server.FinalRequestProcessor (Vulnerable Component) ```

### Vulnerability Details

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Publish Date: 2019-05-23

URL: CVE-2019-0201

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://zookeeper.apache.org/security.html

Release Date: 2019-05-23

Fix Resolution: 3.4.14, 3.5.5

CVE-2021-36373 ### Vulnerable Library - ant-1.10.6.jar

master POM

Library home page: http://ant.apache.org/

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.10.6/ant-1.10.6.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-compressor-all-1.5.0.jar - seata-compressor-bzip2-1.5.0.jar - :x: **ant-1.10.6.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.SentinelWebAutoConfiguration (Application) -> org.apache.catalina.connector.Response (Extension) -> org.apache.catalina.startup.FailedContext (Extension) -> org.apache.tools.ant.types.DirSet (Extension) ... -> org.apache.tools.ant.IntrospectionHelper (Extension) -> org.apache.tools.ant.types.resources.ZipResource (Extension) -> ❌ org.apache.tools.zip.ZipFile (Vulnerable Component) ```

### Vulnerability Details

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Publish Date: 2021-07-14

URL: CVE-2021-36373

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36373

Release Date: 2021-07-14

Fix Resolution (org.apache.ant:ant): 1.10.11

Direct dependency fix Resolution (io.seata:seata-server): 1.6.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-36374 ### Vulnerable Library - ant-1.10.6.jar

master POM

Library home page: http://ant.apache.org/

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/ant/ant/1.10.6/ant-1.10.6.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - seata-compressor-all-1.5.0.jar - seata-compressor-bzip2-1.5.0.jar - :x: **ant-1.10.6.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

This vulnerability is potentially used ``` com.alibaba.cloud.sentinel.SentinelWebAutoConfiguration (Application) -> org.apache.catalina.connector.Response (Extension) -> org.apache.catalina.startup.FailedContext (Extension) -> org.apache.tools.ant.types.DirSet (Extension) ... -> org.apache.tools.ant.IntrospectionHelper (Extension) -> org.apache.tools.ant.types.resources.ZipResource (Extension) -> ❌ org.apache.tools.zip.ZipFile (Vulnerable Component) ```

### Vulnerability Details

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Publish Date: 2021-07-14

URL: CVE-2021-36374

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://ant.apache.org/security.html

Release Date: 2021-07-14

Fix Resolution (org.apache.ant:ant): 1.10.11

Direct dependency fix Resolution (io.seata:seata-server): 1.6.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-8908 ### Vulnerable Library - guava-27.0.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/seata-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/27.0.1-jre/guava-27.0.1-jre.jar

Dependency Hierarchy: - seata-server-1.5.0.jar (Root Library) - :x: **guava-27.0.1-jre.jar** (Vulnerable Library)

Found in HEAD commit: 0eeb18973cfcee9b9fff03100110efae9c5b6aee

Found in base branch: 2022.x

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

### CVSS 3 Score Details (3.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0

:rescue_worker_helmet: Automatic Remediation is available for this issue.

dev-mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.