search

jgeraigery / synapse

Synapse is a set of lightweight foundational framework modules for rapid development, built-in with enterprise-grade maturity and quality.
Apache License 2.0
0 stars 0 forks source link

synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar: 4 vulnerabilities (highest severity is: 7.5) reachable - autoclosed #36

Closed mend-for-github-com[bot] closed 6 months ago

mend-for-github-com[bot] commented 6 months ago
Vulnerable Library - synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/netty/reactor-netty-http/1.0.23/reactor-netty-http-1.0.23.jar

Found in HEAD commit: 7b8cb47d60e217a5471918e15b838e9304037ddc

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (synapse-service-reactive-rest version) Remediation Possible** Reachability
CVE-2023-44487 High 7.5 netty-codec-http2-4.1.82.Final.jar Transitive N/A* ❌

Reachable
CVE-2023-34062 High 7.5 reactor-netty-http-1.0.23.jar Transitive N/A* ❌

Reachable
CVE-2023-34054 High 7.5 reactor-netty-http-1.0.23.jar Transitive N/A* ❌

Reachable
CVE-2022-31684 Medium 4.3 reactor-netty-http-1.0.23.jar Transitive N/A* ❌

Reachable

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-44487 (Reachable) ### Vulnerable Library - netty-codec-http2-4.1.82.Final.jar

Path to dependency file: /service/service-samples/sample-service-reactive-oracle-book/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec-http2/4.1.82.Final/netty-codec-http2-4.1.82.Final.jar

Dependency Hierarchy: - synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar (Root Library) - spring-boot-starter-webflux-2.7.4.jar - spring-boot-starter-reactor-netty-2.7.4.jar - reactor-netty-http-1.0.23.jar - :x: **netty-codec-http2-4.1.82.Final.jar** (Vulnerable Library)

Found in HEAD commit: 7b8cb47d60e217a5471918e15b838e9304037ddc

Found in base branch: develop

### Reachability Analysis This vulnerability is potentially reachable ``` io.americanexpress.service.book.graphql.resolver.query.BookReactiveQueryResolver (Application) -> reactor.netty.http.client.HttpClientConnect$MonoHttpConnect (Extension) -> reactor.netty.http.client.HttpClientConfig (Extension) -> io.netty.handler.codec.http2.Http2FrameCodecBuilder (Extension) -> ❌ io.netty.handler.codec.http2.AbstractHttp2ConnectionHandlerBuilder (Vulnerable Component) ```

### Vulnerability Details

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Publish Date: 2023-10-10

URL: CVE-2023-44487

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44487

Release Date: 2023-10-10

Fix Resolution: org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17, org.eclipse.jetty.http2:jetty-http2-server:12.0.2, org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17, org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0, io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3, org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14, org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3, v1.57.1, v1.58.3

CVE-2023-34062 (Reachable) ### Vulnerable Library - reactor-netty-http-1.0.23.jar

HTTP functionality for the Reactor Netty library

Library home page: https://github.com/

Path to dependency file: /api/synapse-api-rest-reactive/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/netty/reactor-netty-http/1.0.23/reactor-netty-http-1.0.23.jar

Dependency Hierarchy: - synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar (Root Library) - spring-boot-starter-webflux-2.7.4.jar - spring-boot-starter-reactor-netty-2.7.4.jar - :x: **reactor-netty-http-1.0.23.jar** (Vulnerable Library)

Found in HEAD commit: 7b8cb47d60e217a5471918e15b838e9304037ddc

Found in base branch: develop

### Reachability Analysis This vulnerability is potentially reachable ``` io.americanexpress.service.book.graphql.resolver.query.BookReactiveQueryResolver (Application) -> reactor.netty.http.client.HttpClientConnect$MonoHttpConnect (Extension) -> ❌ reactor.netty.http.client.HttpClientConnect$MonoHttpConnect$ClientTransportSubscriber (Vulnerable Component) ```

### Vulnerability Details

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Publish Date: 2023-11-15

URL: CVE-2023-34062

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34062

Release Date: 2023-11-15

Fix Resolution: io.projectreactor.netty:reactor-netty-http:1.0.39,1.1.13

CVE-2023-34054 (Reachable) ### Vulnerable Library - reactor-netty-http-1.0.23.jar

HTTP functionality for the Reactor Netty library

Library home page: https://github.com/

Path to dependency file: /api/synapse-api-rest-reactive/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/netty/reactor-netty-http/1.0.23/reactor-netty-http-1.0.23.jar

Dependency Hierarchy: - synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar (Root Library) - spring-boot-starter-webflux-2.7.4.jar - spring-boot-starter-reactor-netty-2.7.4.jar - :x: **reactor-netty-http-1.0.23.jar** (Vulnerable Library)

Found in HEAD commit: 7b8cb47d60e217a5471918e15b838e9304037ddc

Found in base branch: develop

### Reachability Analysis This vulnerability is potentially reachable ``` io.americanexpress.service.book.graphql.resolver.query.BookReactiveQueryResolver (Application) -> reactor.netty.http.client.HttpClientConnect$MonoHttpConnect (Extension) -> reactor.netty.http.client.HttpClientConfig (Extension) -> reactor.netty.http.client.HttpClientOperations (Extension) -> ❌ reactor.netty.http.client.WebsocketClientOperations (Vulnerable Component) ```

### Vulnerability Details

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Publish Date: 2023-11-28

URL: CVE-2023-34054

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34054

Release Date: 2023-11-28

Fix Resolution: io.projectreactor.netty:reactor-netty:1.0.39,1.1.13, io.projectreactor.netty:reactor-netty-http:1.0.39,1.1.13

CVE-2022-31684 (Reachable) ### Vulnerable Library - reactor-netty-http-1.0.23.jar

HTTP functionality for the Reactor Netty library

Library home page: https://github.com/

Path to dependency file: /api/synapse-api-rest-reactive/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/netty/reactor-netty-http/1.0.23/reactor-netty-http-1.0.23.jar

Dependency Hierarchy: - synapse-service-reactive-rest-0.3.32-SNAPSHOT.jar (Root Library) - spring-boot-starter-webflux-2.7.4.jar - spring-boot-starter-reactor-netty-2.7.4.jar - :x: **reactor-netty-http-1.0.23.jar** (Vulnerable Library)

Found in HEAD commit: 7b8cb47d60e217a5471918e15b838e9304037ddc

Found in base branch: develop

### Reachability Analysis This vulnerability is potentially reachable ``` io.americanexpress.synapse.service.reactive.rest.config.BaseServiceReactiveRestConfig (Application) -> org.springframework.web.reactive.config.EnableWebFlux (Extension) -> org.springframework.web.reactive.config.DelegatingWebFluxConfiguration (Extension) -> reactor.netty.http.server.HttpServer (Extension) ... -> reactor.netty.http.server.HttpServerMetricsHandler (Extension) -> reactor.netty.http.server.HttpServerOperations (Extension) -> ❌ reactor.netty.http.server.WebsocketServerOperations (Vulnerable Component) ```

### Vulnerability Details

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Publish Date: 2022-10-19

URL: CVE-2022-31684

### CVSS 3 Score Details (4.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-7w4x-4h67-pgmv

Release Date: 2022-10-19

Fix Resolution: io.projectreactor.netty:reactor-netty-http:1.0.24

mend-for-github-com[bot] commented 6 months ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #37

mend-for-github-com[bot] commented 6 months ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #37