search

snowdensb / job-dsl-plugin

A Groovy DSL for Jenkins Jobs - Sweeeeet!
Apache License 2.0
0 stars 0 forks source link

CVE-2021-23369 (Critical) detected in multiple libraries - autoclosed #209

Closed mend-for-github-com[bot] closed 7 months ago

mend-for-github-com[bot] commented 1 year ago

CVE-2021-23369 - Critical Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.2.jar, handlebars-4.0.2.js, handlebars-4.0.2.min.js

handlebars-4.0.2.jar

WebJar for Handlebars

Library home page: http://webjars.org

Path to dependency file: /job-dsl-api-viewer/build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/handlebars/4.0.2/259c7e47df1d59761c33f3d4a77a0b9673153af4/handlebars-4.0.2.jar

Dependency Hierarchy: - :x: **handlebars-4.0.2.jar** (Vulnerable Library)

handlebars-4.0.2.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.2/handlebars.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/handlebars/4.0.2/handlebars.js

Dependency Hierarchy: - :x: **handlebars-4.0.2.js** (Vulnerable Library)

handlebars-4.0.2.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.2/handlebars.min.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/handlebars/4.0.2/handlebars.min.js

Dependency Hierarchy: - :x: **handlebars-4.0.2.min.js** (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-04-12

Fix Resolution: 4.0.11

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 7 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.