CVE-2015-5237 (High) detected in protobuf-java-3.2.0.jar

[mend-for-github-com[bot]]

CVE-2015-5237 - High Severity Vulnerability

Vulnerable Library - protobuf-java-3.2.0.jar

Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format.

Library home page: https://developers.google.com/protocol-buffers/

Path to dependency file: /tools/reminder-bot/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/protobuf/protobuf-java/3.2.0/protobuf-java-3.2.0.jar

Dependency Hierarchy: - stanford-corenlp-3.9.2.jar (Root Library) - :x: **protobuf-java-3.2.0.jar** (Vulnerable Library)

Found in HEAD commit: 3da9e0f849079934eb92135cec1f523e22bdc1ad

Found in base branch: spring-bot-master

Vulnerability Details

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Publish Date: 2017-09-25

URL: CVE-2015-5237

CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/protocolbuffers/protobuf/releases/tag/v3.4.0

Release Date: 2017-09-25

Fix Resolution: 3.4.0

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.