search

amaybaum-prod / jib

🏗 Build container images for your Java applications.
Apache License 2.0
0 stars 1 forks source link

shared-library-0.1.0.jar: 131 vulnerabilities (highest severity is: 10.0) #22

Open mend-for-github-com[bot] opened 11 months ago

mend-for-github-com[bot] commented 11 months ago
Vulnerable Library - shared-library-0.1.0.jar

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (shared-library version) Remediation Possible** Reachability
CVE-2018-14721 Critical 10.0 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2022-22965 Critical 9.8 spring-beans-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2020-9548 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-9547 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-9546 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-8840 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-20330 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-17531 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-17267 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-16943 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-16942 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-16335 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-14893 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-14892 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-14540 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-14379 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-10202 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-8014 Critical 9.8 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2018-19362 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-19361 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-19360 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-14720 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-14719 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-14718 Critical 9.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2016-1000027 Critical 9.8 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2020-11113 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-11112 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-11111 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-10969 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-10968 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-10673 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-10672 High 8.8 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2022-1471 High 8.3 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2024-22262 High 8.1 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-22259 High 8.1 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-22243 High 8.1 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2021-20190 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36189 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36188 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36187 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36186 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36185 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36184 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36183 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36182 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36181 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36180 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-36179 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-35728 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-35491 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-35490 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-24750 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-24616 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-14195 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-14062 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-14061 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-14060 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-11620 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-11619 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-10650 High 8.1 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-0232 High 8.1 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2022-27772 High 7.8 spring-boot-2.0.3.RELEASE.jar Transitive N/A* ❌
CVE-2024-38819 High 7.5 spring-webmvc-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-38816 High 7.5 spring-webmvc-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-24549 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-46589 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-44487 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-24998 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-20883 High 7.5 spring-boot-autoconfigure-2.0.3.RELEASE.jar Transitive N/A* ❌
CVE-2022-42252 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2022-42004 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2022-42003 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2022-25857 High 7.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2021-41079 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2021-25122 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2020-5398 High 7.5 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2020-36518 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-25649 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2020-17527 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2020-13935 High 7.5 tomcat-embed-websocket-8.5.31.jar Transitive N/A* ❌
CVE-2020-13934 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2019-17563 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2019-14439 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-12086 High 7.5 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-10072 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2019-0199 High 7.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2018-8034 High 7.5 tomcat-embed-websocket-8.5.31.jar Transitive N/A* ❌
CVE-2018-15756 High 7.5 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2017-18640 High 7.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2023-6481 High 7.1 logback-core-1.2.3.jar Transitive N/A* ❌
CVE-2023-6378 High 7.1 logback-classic-1.2.3.jar Transitive N/A* ❌
CVE-2021-25329 High 7.0 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2020-9484 High 7.0 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2021-42550 Medium 6.6 detected in multiple dependencies Transitive N/A* ❌
CVE-2023-20863 Medium 6.5 spring-expression-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2023-20861 Medium 6.5 spring-expression-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2022-38752 Medium 6.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2022-38751 Medium 6.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2022-38750 Medium 6.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2022-38749 Medium 6.5 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2022-22950 Medium 6.5 spring-expression-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2021-30640 Medium 6.5 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2020-5421 Medium 6.5 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2018-1000873 Medium 6.5 jackson-datatype-jsr310-2.9.6.jar Transitive N/A* ❌
WS-2021-0172 Medium 6.3 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-23672 Medium 6.3 tomcat-embed-websocket-8.5.31.jar Transitive N/A* ❌
CVE-2023-41080 Medium 6.1 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-1932 Medium 6.1 hibernate-validator-6.0.10.Final.jar Transitive N/A* ❌
CVE-2019-10219 Medium 6.1 hibernate-validator-6.0.10.Final.jar Transitive N/A* ❌
CVE-2019-0221 Medium 6.1 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2021-24122 Medium 5.9 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2019-12814 Medium 5.9 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2019-12384 Medium 5.9 jackson-databind-2.9.6.jar Transitive N/A* ❌
CVE-2018-8037 Medium 5.9 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2022-41854 Medium 5.8 snakeyaml-1.19.jar Transitive N/A* ❌
CVE-2024-38809 Medium 5.3 spring-web-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2024-21733 Medium 5.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-45648 Medium 5.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2023-42795 Medium 5.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2022-22970 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-22968 Medium 5.3 spring-context-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2021-33037 Medium 5.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2020-10693 Medium 5.3 hibernate-validator-6.0.10.Final.jar Transitive N/A* ❌
CVE-2020-1935 Medium 4.8 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2024-38808 Medium 4.3 spring-expression-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2023-28708 Medium 4.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2021-22096 Medium 4.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2021-22060 Medium 4.3 spring-core-5.0.7.RELEASE.jar Transitive N/A* ❌
CVE-2020-13943 Medium 4.3 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2021-43980 Low 3.7 tomcat-embed-core-8.5.31.jar Transitive N/A* ❌
CVE-2024-38820 Low 3.1 spring-context-5.0.7.RELEASE.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (12 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2018-14721 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.6.7.3,2.7.9.5,2.8.11.3,2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14721

### CVSS 3 Score Details (10.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.5,2.8.11.3,2.9.7

CVE-2022-22965 ### Vulnerable Library - spring-beans-5.0.7.RELEASE.jar

Spring Beans

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /examples/multi-module/hello-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.0.7.RELEASE/spring-beans-5.0.7.RELEASE.jar,/home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.0.7.RELEASE/spring-beans-5.0.7.RELEASE.jar,/home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.0.7.RELEASE/spring-beans-5.0.7.RELEASE.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-2.0.3.RELEASE.jar - spring-boot-2.0.3.RELEASE.jar - spring-context-5.0.7.RELEASE.jar - spring-aop-5.0.7.RELEASE.jar - :x: **spring-beans-5.0.7.RELEASE.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Mend Note: Converted from WS-2022-0107, on 2022-11-07.

Publish Date: 2022-04-01

URL: CVE-2022-22965

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Release Date: 2022-04-01

Fix Resolution: org.springframework:spring-beans:5.2.20.RELEASE,5.3.18

CVE-2020-9548 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.7,2.8.11.6,2.9.10.4

CVE-2020-9547 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3

CVE-2020-9546 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3

CVE-2020-8840 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-02-10

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.3

CVE-2019-20330 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03

URL: CVE-2019-20330

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-01-03

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.7,2.8.11.5,2.9.10.2

CVE-2019-17531 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.10

CVE-2019-17267 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-06

URL: CVE-2019-17267

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-10-06

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10

CVE-2019-16943 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943

Release Date: 2019-10-01

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1

CVE-2019-16942 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942

Release Date: 2019-10-01

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1

CVE-2019-16335 ### Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /examples/multi-module/name-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Dependency Hierarchy: - shared-library-0.1.0.jar (Root Library) - spring-boot-starter-web-2.0.3.RELEASE.jar - spring-boot-starter-json-2.0.3.RELEASE.jar - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

Publish Date: 2019-09-15

URL: CVE-2019-16335

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-09-15

Fix Resolution: 2.9.10