search

gsylvie / t

t
0 stars 0 forks source link

CVE-2024-23082 (High) detected in threetenbp-1.3.3.jar - autoclosed #390

Closed mend-bolt-for-github[bot] closed 5 months ago

mend-bolt-for-github[bot] commented 7 months ago

CVE-2024-23082 - High Severity Vulnerability

Vulnerable Library - threetenbp-1.3.3.jar

Backport of JSR-310 from JDK 8 to JDK 7 and JDK 6. NOT an implementation of the JSR.

Library home page: https://www.threeten.org/threetenbp

Path to dependency file: /t/sub1/pom.xml

Path to vulnerable library: /2/repository/org/threeten/threetenbp/1.3.3/threetenbp-1.3.3.jar

Dependency Hierarchy: - :x: **threetenbp-1.3.3.jar** (Vulnerable Library)

Found in HEAD commit: 37c7d89138d443bae9926a0184046f8d8c7dda51

Found in base branch: master

Vulnerability Details

ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Publish Date: 2024-04-08

URL: CVE-2024-23082

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 5 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.