search

ams0 / openhack-containers

MIT License
0 stars 0 forks source link

CVE-2024-23081 (Medium) detected in threetenbp-1.3.1.jar - autoclosed #234

Closed mend-bolt-for-github[bot] closed 6 months ago

mend-bolt-for-github[bot] commented 7 months ago

CVE-2024-23081 - Medium Severity Vulnerability

Vulnerable Library - threetenbp-1.3.1.jar

Backport of JSR-310 from JDK 8 to JDK 7 and JDK 6. NOT an implementation of the JSR.

Library home page: https://www.threeten.org/threetenbp

Path to dependency file: /src/user-java/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/threeten/threetenbp/1.3.1/threetenbp-1.3.1.jar

Dependency Hierarchy: - jackson-datatype-threetenbp-2.6.4.jar (Root Library) - :x: **threetenbp-1.3.1.jar** (Vulnerable Library)

Found in HEAD commit: fbc3a9665f7473faa96484a3fa9b058ad82d7e60

Found in base branch: master

Vulnerability Details

ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate).

Publish Date: 2024-04-08

URL: CVE-2024-23081

CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 6 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.