Closed mend-for-github-com[bot] closed 1 year ago
The vulnerability is transitive and retrofit2 2.9.0 has kotlin stdlib 1.3.50 as dependency. Since 2.9.0 is the last release of retorfit, the fix is unavailable.
Thanks, @goncalocostamendes. I'll close this now.
Kotlin Standard Library for JVM
Path to dependency file: /Archiving-Java/app/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.4.10/1ae8d0e617a4e272ce07664ad928c57b171e31f9/kotlin-stdlib-1.4.10.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.4.10/1ae8d0e617a4e272ce07664ad928c57b171e31f9/kotlin-stdlib-1.4.10.pom
Vulnerabilities
Details
CVE-2022-24329
### Vulnerable Library - kotlin-stdlib-1.4.10.jarKotlin Standard Library for JVM
Path to dependency file: /Archiving-Java/app/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.4.10/1ae8d0e617a4e272ce07664ad928c57b171e31f9/kotlin-stdlib-1.4.10.pom,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.4.10/1ae8d0e617a4e272ce07664ad928c57b171e31f9/kotlin-stdlib-1.4.10.pom
Dependency Hierarchy: - :x: **kotlin-stdlib-1.4.10.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
Publish Date: 2022-02-25
URL: CVE-2022-24329
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-2qp4-g3q3-f92w
Release Date: 2022-02-25
Fix Resolution: 1.6.0-M1
:rescue_worker_helmet: Automatic Remediation is available for this issue:rescue_worker_helmet: Automatic Remediation is available for this issue.