search

amaybaum-prod / atom-hopper

ATOM Hopper - The Java ATOMpub Server
http://atomhopper.org
0 stars 2 forks source link

commons-collections-3.2.1.jar: 3 vulnerabilities (highest severity is: 9.8) - autoclosed #28

Closed mend-for-github-com[bot] closed 4 months ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - commons-collections-3.2.1.jar

Library home page: http://archive.apache.org/dist/openmeetings/3.1.1/bin/apache-openmeetings-3.1.1.tar.gz

Path to vulnerable library: /tests/regression/target/jmeter/lib/commons-collections-3.2.1.jar

Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (commons-collections version) Remediation Possible** Reachability
CVE-2019-13116 Critical 9.8 commons-collections-3.2.1.jar Direct commons-collections:commons-collections:3.2.2 ❌
CVE-2017-15708 Critical 9.8 commons-collections-3.2.1.jar Direct org.apache.synapse:Apache-Synapse:3.0.1;commons-collections:commons-collections:3.2.2 ❌
CVE-2015-7501 Critical 9.8 commons-collections-3.2.1.jar Direct commons-collections:commons-collections:3.2.2;org.apache.commons:commons-collections4:4.1 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-13116 ### Vulnerable Library - commons-collections-3.2.1.jar

Library home page: http://archive.apache.org/dist/openmeetings/3.1.1/bin/apache-openmeetings-3.1.1.tar.gz

Path to vulnerable library: /tests/regression/target/jmeter/lib/commons-collections-3.2.1.jar

Dependency Hierarchy: - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298

Found in base branch: master

### Vulnerability Details

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections

Publish Date: 2019-10-16

URL: CVE-2019-13116

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13116

Release Date: 2019-10-16

Fix Resolution: commons-collections:commons-collections:3.2.2

CVE-2017-15708 ### Vulnerable Library - commons-collections-3.2.1.jar

Library home page: http://archive.apache.org/dist/openmeetings/3.1.1/bin/apache-openmeetings-3.1.1.tar.gz

Path to vulnerable library: /tests/regression/target/jmeter/lib/commons-collections-3.2.1.jar

Dependency Hierarchy: - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298

Found in base branch: master

### Vulnerability Details

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Publish Date: 2017-12-11

URL: CVE-2017-15708

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15708

Release Date: 2017-12-10

Fix Resolution: org.apache.synapse:Apache-Synapse:3.0.1;commons-collections:commons-collections:3.2.2

CVE-2015-7501 ### Vulnerable Library - commons-collections-3.2.1.jar

Library home page: http://archive.apache.org/dist/openmeetings/3.1.1/bin/apache-openmeetings-3.1.1.tar.gz

Path to vulnerable library: /tests/regression/target/jmeter/lib/commons-collections-3.2.1.jar

Dependency Hierarchy: - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298

Found in base branch: master

### Vulnerability Details

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Publish Date: 2017-11-09

URL: CVE-2015-7501

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1279330

Release Date: 2017-11-09

Fix Resolution: commons-collections:commons-collections:3.2.2;org.apache.commons:commons-collections4:4.1

mend-for-github-com[bot] commented 4 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.