search

safat / conductor

Conductor is a microservices orchestration engine - https://netflix.github.io/conductor/
Apache License 2.0
1 stars 0 forks source link

CVE-2022-45685 (High) detected in jettison-1.3.7.jar #289

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2022-45685 - High Severity Vulnerability

Vulnerable Library - jettison-1.3.7.jar

A StAX implementation for JSON.

Path to dependency file: /test-harness/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.codehaus.jettison/jettison/1.3.7/7d36a59a0577f11b12088b9e215d6860345b9e1d/jettison-1.3.7.jar

Dependency Hierarchy: - dyno-queues-redis-2.0.13.jar (Root Library) - dyno-jedis-1.7.2-rc2.jar - dyno-contrib-1.7.2-rc2.jar - eureka-client-1.8.6.jar - :x: **jettison-1.3.7.jar** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.

Publish Date: 2022-12-13

URL: CVE-2022-45685

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-12-13

Fix Resolution: org.codehaus.jettison:jettison:1.5.2

Step up your Open Source Security Game with Mend here