Open mend-for-github-com[bot] opened 4 months ago
Spring Vault Core Components
Library home page: https://projects.spring.io/spring-vault/
Path to dependency file: /nifi-commons/nifi-vault-utils/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184319/spring-vault-core-2.3.2.jar
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Dependency Hierarchy: - :x: **spring-vault-core-2.3.2.jar** (Vulnerable Library)
Found in base branch: main
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Publish Date: 2023-03-23
URL: CVE-2023-20859
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-20859
Release Date: 2023-03-23
Fix Resolution: 2.3.3
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
Spring Vault Core Components
Library home page: https://projects.spring.io/spring-vault/
Path to dependency file: /nifi-commons/nifi-vault-utils/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184319/spring-vault-core-2.3.2.jar
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-20859
### Vulnerable Library - spring-vault-core-2.3.2.jarSpring Vault Core Components
Library home page: https://projects.spring.io/spring-vault/
Path to dependency file: /nifi-commons/nifi-vault-utils/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184319/spring-vault-core-2.3.2.jar
Dependency Hierarchy: - :x: **spring-vault-core-2.3.2.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Publish Date: 2023-03-23
URL: CVE-2023-20859
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/security/cve-2023-20859
Release Date: 2023-03-23
Fix Resolution: 2.3.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.