search

indigo-dc / orchestrator

The INDIGO PaaS Orchestrator
https://www.indigo-datacloud.eu/paas-orchestrator
Apache License 2.0
16 stars 21 forks source link

[Snyk] Fix for 18 vulnerabilities #407

Closed snyk-bot closed 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Information Exposure
SNYK-JAVA-COMMONSCODEC-561518		 No No Known Exploit
high severity 649/1000
Why? Has a fix available, CVSS 8.7		 Elliptic Curve Key Disclosure
SNYK-JAVA-COMNIMBUSDS-30205		 com.mesosphere:marathon-client:
0.6.2 -> 0.6.3
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Invalid Elliptic Curve Attack
SNYK-JAVA-COMNIMBUSDS-31558		 com.mesosphere:marathon-client:
0.6.2 -> 0.6.3
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Improper Check for Unusual or Exceptional Conditions
SNYK-JAVA-COMNIMBUSDS-536068		 com.mesosphere:marathon-client:
0.6.2 -> 0.6.3
No No Known Exploit
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Security Bypass
SNYK-JAVA-IOUNDERTOW-567266		 Yes No Known Exploit
high severity 801/1000
Why? Mature exploit, Has a fix available, CVSS 8.3		 Arbitrary File Upload
SNYK-JAVA-IOUNDERTOW-567770		 Yes Mature
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JAVA-IOUNDERTOW-568918		 Yes No Known Exploit
high severity 605/1000
Why? Has a fix available, CVSS 7.6		 HTTP Request Smuggling
SNYK-JAVA-IOUNDERTOW-570455		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Insecure Default
SNYK-JAVA-ORGAPACHEANT-569130		 No No Known Exploit
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHEIGNITE-456561		 org.apache.ignite:ignite-slf4j:
2.3.0 -> 2.8.1
org.apache.ignite:ignite-spring:
2.3.0 -> 2.8.1
No No Known Exploit
high severity 669/1000
Why? Has a fix available, CVSS 9.1		 Incorrect Authorization
SNYK-JAVA-ORGAPACHEIGNITE-571662		 org.apache.ignite:ignite-slf4j:
2.3.0 -> 2.8.1
org.apache.ignite:ignite-spring:
2.3.0 -> 2.8.1
No No Known Exploit
low severity 369/1000
Why? Has a fix available, CVSS 3.1		 Session Fixation
SNYK-JAVA-ORGAPACHETOMCATEMBED-538488		 Yes No Known Exploit
high severity 791/1000
Why? Mature exploit, Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHETOMCATEMBED-570072		 Yes Mature
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHETOMCATEMBED-584427		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JAVA-ORGHIBERNATE-568162		 Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 SQL Injection
SNYK-JAVA-ORGHIBERNATE-584563		 Yes No Known Exploit
high severity 635/1000
Why? Has a fix available, CVSS 8.2		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGPOSTGRESQL-571481		 No No Known Exploit
medium severity 440/1000
Why? Has a fix available, CVSS 4.3		 Denial of Service (DoS)
SNYK-JAVA-ORGYAML-537645		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Vulnerabilities that could not be fixed

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

t6pc-bot commented 3 years ago

Can one of the admins verify this patch?

sonarcloud[bot] commented 3 years ago

Kudos, SonarCloud Quality Gate passed!

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities (and Security Hotspot 0 Security Hotspots to review)
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

warning The version of Java (1.8.0_252) you have used to run this analysis is deprecated and we will stop accepting it from October 2020. Please update to at least Java 11. Read more here

codecov-commenter commented 3 years ago

Codecov Report

Merging #407 into master will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff            @@
##             master     #407   +/-   ##
=========================================
  Coverage     58.99%   58.99%           
  Complexity     1059     1059           
=========================================
  Files           220      220           
  Lines          6731     6731           
  Branches        452      452           
=========================================
  Hits           3971     3971           
  Misses         2587     2587           
  Partials        173      173
Flag Coverage Δ Complexity Δ
#integration 7.11% <ø> (ø) 193.00 <ø> (ø)
#unittests 55.02% <ø> (ø) 955.00 <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 85fb1a3...404f03e. Read the comment docs.

codecov-io commented 3 years ago

Codecov Report

Merging #407 (404f03e) into master (85fb1a3) will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff            @@
##             master     #407   +/-   ##
=========================================
  Coverage     58.99%   58.99%           
  Complexity     1059     1059           
=========================================
  Files           220      220           
  Lines          6731     6731           
  Branches        452      452           
=========================================
  Hits           3971     3971           
  Misses         2587     2587           
  Partials        173      173
Flag Coverage Δ Complexity Δ
integration 7.11% <ø> (ø) 0.00 <ø> (ø)
unittests 55.02% <ø> (ø) 0.00 <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 85fb1a3...404f03e. Read the comment docs.

maricaantonacci commented 3 years ago

Superseded by https://github.com/indigo-dc/orchestrator/pull/411