search

jgeraigery / front50---Demo

Spinnaker Metadata Repository Service
Apache License 2.0
0 stars 0 forks source link

kork-bom-7.126.0.pom: 59 vulnerabilities (highest severity is: 9.8) #27

Open mend-for-github-com[bot] opened 1 year ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - kork-bom-7.126.0.pom

Path to dependency file: /front50-sql-postgres/front50-sql-postgres.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.12.RELEASE/8c31df01a9ee2b9fa3c3a2e75551dbc5e1447fec/spring-expression-5.2.12.RELEASE.jar

Found in HEAD commit: 030c85bbbd79c49a42f0cc49719b8c41bd782262

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (kork-bom version) Remediation Possible** Reachability
CVE-2024-52316 Critical 9.8 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2019-17495 Critical 9.8 Not Defined 2.2% springfox-swagger-ui-2.9.2.jar Transitive N/A* ❌
CVE-2021-22573 High 8.7 Not Defined 0.1% google-oauth-client-1.31.0.jar Transitive N/A* ❌
CVE-2024-38286 High 8.6 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2022-1471 High 8.3 Not Defined 2.1% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2024-25710 High 8.1 Not Defined 0.1% commons-compress-1.21.jar Transitive N/A* ❌
WS-2014-0065 High 7.5 Not Defined jna-platform-4.5.2.jar Transitive N/A* ❌
CVE-2024-34750 High 7.5 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2024-30172 High 7.5 Not Defined 0.0% bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2024-29857 High 7.5 Not Defined bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2024-24549 High 7.5 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2024-21634 High 7.5 Not Defined 0.0% ion-java-1.0.2.jar Transitive N/A* ❌
CVE-2023-52428 High 7.5 Not Defined 0.0% detected in multiple dependencies Transitive N/A* ❌
CVE-2023-46589 High 7.5 Not Defined 0.5% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-44487 High 7.5 High 83.8% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-24998 High 7.5 Not Defined 2.2% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-1370 High 7.5 Not Defined 0.1% json-smart-2.4.1.jar Transitive N/A* ❌
CVE-2022-45143 High 7.5 Not Defined 0.3% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2022-42252 High 7.5 Not Defined 0.2% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2022-25857 High 7.5 Not Defined 0.2% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2021-37714 High 7.5 Not Defined 0.9% jsoup-1.10.3.jar Transitive N/A* ❌
CVE-2021-31684 High 7.5 Not Defined 1.1% json-smart-2.4.1.jar Transitive N/A* ❌
CVE-2020-11979 High 7.5 Not Defined 0.2% ant-1.9.15.jar Transitive N/A* ❌
CVE-2017-18640 High 7.5 Not Defined 1.9% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2023-6378 High 7.1 Not Defined 0.1% logback-classic-1.2.3.jar Transitive N/A* ❌
CVE-2022-23181 High 7.0 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2021-42550 Medium 6.6 Not Defined 1.6% logback-classic-1.2.3.jar Transitive N/A* ❌
CVE-2024-52317 Medium 6.5 Not Defined 0.0% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-20863 Medium 6.5 Not Defined 0.2% spring-expression-5.2.12.RELEASE.jar Transitive N/A* ❌
CVE-2023-20861 Medium 6.5 Not Defined 0.1% spring-expression-5.2.12.RELEASE.jar Transitive N/A* ❌
CVE-2022-38752 Medium 6.5 Not Defined 1.0% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2022-38751 Medium 6.5 Not Defined 0.2% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2022-38750 Medium 6.5 Not Defined 0.1% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2022-38749 Medium 6.5 Not Defined 0.2% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2022-22950 Medium 6.5 Not Defined 0.1% spring-expression-5.2.12.RELEASE.jar Transitive N/A* ❌
CVE-2021-37533 Medium 6.5 Not Defined 0.3% commons-net-3.3.jar Transitive N/A* ❌
CVE-2024-23672 Medium 6.3 Not Defined 0.0% tomcat-embed-websocket-9.0.48.jar Transitive N/A* ❌
CVE-2021-28168 Medium 6.2 Not Defined 0.0% jersey-common-2.29.1.jar Transitive N/A* ❌
CVE-2023-41080 Medium 6.1 Not Defined 0.70000005% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-1932 Medium 6.1 Not Defined 0.0% hibernate-validator-6.0.22.Final.jar Transitive N/A* ❌
CVE-2022-36033 Medium 6.1 Not Defined 0.1% jsoup-1.10.3.jar Transitive N/A* ❌
CVE-2024-30171 Medium 5.9 Not Defined 0.0% bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2023-3635 Medium 5.9 Not Defined 0.1% okio-1.17.2.jar Transitive N/A* ❌
CVE-2021-27568 Medium 5.9 Not Defined 1.0% json-smart-2.4.1.jar Transitive N/A* ❌
CVE-2020-15522 Medium 5.9 Not Defined 0.1% bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2022-41854 Medium 5.8 Not Defined 0.6% snakeyaml-1.25.jar Transitive N/A* ❌
CVE-2024-26308 Medium 5.5 Not Defined 0.1% commons-compress-1.21.jar Transitive N/A* ❌
CVE-2023-33202 Medium 5.5 Not Defined 0.0% bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2022-4065 Medium 5.5 Not Defined 0.1% testng-7.4.0.jar Transitive N/A* ❌
CVE-2021-36374 Medium 5.5 Not Defined 0.1% ant-1.9.15.jar Transitive N/A* ❌
CVE-2021-36373 Medium 5.5 Not Defined 0.1% ant-1.9.15.jar Transitive N/A* ❌
CVE-2023-45648 Medium 5.3 Not Defined 0.4% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-42795 Medium 5.3 Not Defined 1.7% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2023-34055 Medium 5.3 Not Defined 0.1% spring-boot-actuator-2.2.13.RELEASE.jar Transitive N/A* ❌
CVE-2023-33201 Medium 5.3 Not Defined 0.1% bcprov-jdk15on-1.64.jar Transitive N/A* ❌
CVE-2024-38808 Medium 4.3 Not Defined 0.0% spring-expression-5.2.12.RELEASE.jar Transitive N/A* ❌
CVE-2023-28708 Medium 4.3 Not Defined 0.1% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌
CVE-2018-25031 Medium 4.3 Not Defined 0.4% springfox-swagger-ui-2.9.2.jar Transitive N/A* ❌
CVE-2021-43980 Low 3.7 Not Defined 0.2% tomcat-embed-core-9.0.48.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (12 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2024-52316 ### Vulnerable Library - tomcat-embed-core-9.0.48.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /front50-s3/front50-s3.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.48/f112cd2380d8215e22ac40aff128a1b6daa2f0ac/tomcat-embed-core-9.0.48.jar

Dependency Hierarchy: - kork-bom-7.126.0.pom (Root Library) - :x: **tomcat-embed-core-9.0.48.jar** (Vulnerable Library)

Found in HEAD commit: 030c85bbbd79c49a42f0cc49719b8c41bd782262

Found in base branch: master

### Vulnerability Details

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Publish Date: 2024-11-18

URL: CVE-2024-52316

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-11.html

Release Date: 2024-11-18

Fix Resolution: org.apache.tomcat:tomcat-catalina:9.0.96,10.1.31,11.0.0, org.apache.tomcat.embed:tomcat-embed-core:9.0.96,10.1.31,11.0.0

CVE-2019-17495 ### Vulnerable Library - springfox-swagger-ui-2.9.2.jar

JSON API documentation for spring based applications

Library home page: https://github.com/springfox/springfox

Path to dependency file: /front50-api-tck/front50-api-tck.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.springfox/springfox-swagger-ui/2.9.2/d542382a88ff3ea8d4032c28b2b0325797fada7d/springfox-swagger-ui-2.9.2.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.springfox/springfox-swagger-ui/2.9.2/d542382a88ff3ea8d4032c28b2b0325797fada7d/springfox-swagger-ui-2.9.2.jar

Dependency Hierarchy: - kork-bom-7.126.0.pom (Root Library) - :x: **springfox-swagger-ui-2.9.2.jar** (Vulnerable Library)

Found in HEAD commit: 030c85bbbd79c49a42f0cc49719b8c41bd782262

Found in base branch: master

### Vulnerability Details

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that