search

gsylvie / t

t
0 stars 0 forks source link

CVE-2024-23081 (Critical) detected in threetenbp-1.3.3.jar - autoclosed #391

Closed mend-bolt-for-github[bot] closed 3 months ago

mend-bolt-for-github[bot] commented 5 months ago

CVE-2024-23081 - Critical Severity Vulnerability

Vulnerable Library - threetenbp-1.3.3.jar

Backport of JSR-310 from JDK 8 to JDK 7 and JDK 6. NOT an implementation of the JSR.

Library home page: https://www.threeten.org/threetenbp

Path to dependency file: /t/sub1/pom.xml

Path to vulnerable library: /2/repository/org/threeten/threetenbp/1.3.3/threetenbp-1.3.3.jar

Dependency Hierarchy: - :x: **threetenbp-1.3.3.jar** (Vulnerable Library)

Found in HEAD commit: 37c7d89138d443bae9926a0184046f8d8c7dda51

Found in base branch: master

Vulnerability Details

ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Publish Date: 2024-04-08

URL: CVE-2024-23081

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 3 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.