search

krhrtky / self-hr

0 stars 0 forks source link

graphql-dgs-platform-dependencies-7.3.6.pom: 9 vulnerabilities (highest severity is: 8.3) - autoclosed #6

Closed mend-bolt-for-github[bot] closed 8 months ago

mend-bolt-for-github[bot] commented 11 months ago
Vulnerable Library - graphql-dgs-platform-dependencies-7.3.6.pom

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (graphql-dgs-platform-dependencies version) Remediation Possible**
CVE-2023-22102 High 8.3 mysql-connector-j-8.0.33.jar Transitive N/A* ❌
CVE-2023-6481 High 7.5 logback-core-1.4.8.jar Transitive N/A* ❌
CVE-2023-44487 High 7.5 tomcat-embed-core-10.1.11.jar Transitive N/A* ❌
CVE-2023-46589 High 7.5 tomcat-embed-core-10.1.11.jar Transitive N/A* ❌
CVE-2023-6378 High 7.5 logback-classic-1.4.8.jar Transitive N/A* ❌
CVE-2023-34055 Medium 6.5 spring-boot-3.1.2.jar Transitive N/A* ❌
CVE-2023-41080 Medium 6.1 tomcat-embed-core-10.1.11.jar Transitive N/A* ❌
CVE-2023-42795 Medium 5.3 tomcat-embed-core-10.1.11.jar Transitive N/A* ❌
CVE-2023-45648 Medium 5.3 tomcat-embed-core-10.1.11.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-22102 ### Vulnerable Library - mysql-connector-j-8.0.33.jar

JDBC Type 4 driver for MySQL.

Library home page: http://dev.mysql.com/doc/connector-j/en/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.mysql/mysql-connector-j/8.0.33/9e64d997873abc4318620264703d3fdb6b02dd5a/mysql-connector-j-8.0.33.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **mysql-connector-j-8.0.33.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Publish Date: 2023-10-17

URL: CVE-2023-22102

### CVSS 3 Score Details (8.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-22102

Release Date: 2023-10-17

Fix Resolution: com.mysql:mysql-connector-j:8.2.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-6481 ### Vulnerable Library - logback-core-1.4.8.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /backend/infrastructure/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.4.8/3fba9c105e0efc5ffdcda701379687917d5286f7/logback-core-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.4.8/3fba9c105e0efc5ffdcda701379687917d5286f7/logback-core-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.4.8/3fba9c105e0efc5ffdcda701379687917d5286f7/logback-core-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.4.8/3fba9c105e0efc5ffdcda701379687917d5286f7/logback-core-1.4.8.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **logback-core-1.4.8.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution: ch.qos.logback:logback-core:1.2.13,1.3.14,1.4.14

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-44487 ### Vulnerable Library - tomcat-embed-core-10.1.11.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **tomcat-embed-core-10.1.11.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Publish Date: 2023-10-10

URL: CVE-2023-44487

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44487

Release Date: 2023-10-10

Fix Resolution: org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17, org.eclipse.jetty.http2:jetty-http2-server:12.0.2, org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17, org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0, io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3, org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14, org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3, v1.57.1, v1.58.3

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-46589 ### Vulnerable Library - tomcat-embed-core-10.1.11.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **tomcat-embed-core-10.1.11.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Publish Date: 2023-11-28

URL: CVE-2023-46589

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-11.html

Release Date: 2023-11-28

Fix Resolution: org.apache.tomcat:tomcat-coyote:8.5.96,9.0.83,10.1.16,11.0.0-M11, org.apache.tomcat.embed:tomcat-embed-core:8.5.96,9.0.83,10.1.16,11.0.0-M11, org.apache.tomcat:tomcat-catalina:8.5.96,9.0.83,10.1.16,11.0.0-M11

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-6378 ### Vulnerable Library - logback-classic-1.4.8.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /backend/applications/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.4.8/f00ba91d993e4d14301b11968d3cacc3be7ef3e1/logback-classic-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.4.8/f00ba91d993e4d14301b11968d3cacc3be7ef3e1/logback-classic-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.4.8/f00ba91d993e4d14301b11968d3cacc3be7ef3e1/logback-classic-1.4.8.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.4.8/f00ba91d993e4d14301b11968d3cacc3be7ef3e1/logback-classic-1.4.8.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **logback-classic-1.4.8.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: ch.qos.logback:logback-classic:1.3.12,1.4.12

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-34055 ### Vulnerable Library - spring-boot-3.1.2.jar

Spring Boot

Library home page: https://spring.io/projects/spring-boot

Path to dependency file: /backend/domains/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/3.1.2/3cf070561716277ec91ebadc07362dd0b4a9f63f/spring-boot-3.1.2.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/3.1.2/3cf070561716277ec91ebadc07362dd0b4a9f63f/spring-boot-3.1.2.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/3.1.2/3cf070561716277ec91ebadc07362dd0b4a9f63f/spring-boot-3.1.2.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/3.1.2/3cf070561716277ec91ebadc07362dd0b4a9f63f/spring-boot-3.1.2.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/3.1.2/3cf070561716277ec91ebadc07362dd0b4a9f63f/spring-boot-3.1.2.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **spring-boot-3.1.2.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath

Publish Date: 2023-11-28

URL: CVE-2023-34055

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34055

Release Date: 2023-11-28

Fix Resolution: org.springframework.boot:spring-boot:2.7.18,3.0.13,3.1.6

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-41080 ### Vulnerable Library - tomcat-embed-core-10.1.11.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **tomcat-embed-core-10.1.11.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application.

Publish Date: 2023-08-25

URL: CVE-2023-41080

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f

Release Date: 2023-08-25

Fix Resolution: org.apache.tomcat:tomcat-catalina:8.5.93,9.0.80,10.1.13,11.0.0-M11, org.apache.tomcat.embed:tomcat-embed-core:8.5.93,9.0.80,10.1.13,11.0.0-M11

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-42795 ### Vulnerable Library - tomcat-embed-core-10.1.11.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **tomcat-embed-core-10.1.11.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

Publish Date: 2023-10-10

URL: CVE-2023-42795

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42795

Release Date: 2023-10-10

Fix Resolution: org.apache.tomcat:tomcat-util - 8.5.94,10.1.14,11.0.0-M12,10.0.0-M1;org.apache.tomcat.embed:tomcat-embed-core - 11.0.0-M12,8.5.94,9.0.81;org.apache.tomcat:tomcat-coyote - 8.5.94,10.0.0-M1,11.0.0-M12,10.1.14;org.apache.tomcat:tomcat-catalina - 8.5.94,10.0.0-M1,10.1.14,11.0.0-M12

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-45648 ### Vulnerable Library - tomcat-embed-core-10.1.11.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /backend/api/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/10.1.11/9d1ba230cbe0dfb410b0beba102eff20e14793a1/tomcat-embed-core-10.1.11.jar

Dependency Hierarchy: - graphql-dgs-platform-dependencies-7.3.6.pom (Root Library) - :x: **tomcat-embed-core-10.1.11.jar** (Vulnerable Library)

Found in HEAD commit: 53e7f9b53610bdb7468f1e98a3153c17d2ea242e

Found in base branch: master

### Vulnerability Details

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

Publish Date: 2023-10-10

URL: CVE-2023-45648

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-45648

Release Date: 2023-10-10

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core - 11.0.0-M12,8.5.94,9.0.81;org.apache.tomcat:tomcat-coyote - 8.5.94,10.0.0-M1,10.1.14,11.0.0-M12

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 8 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.