search

snowdensb / nifi

Apache NiFi
https://nifi.apache.org/
Apache License 2.0
0 stars 0 forks source link

azure-identity-1.0.6.jar: 11 vulnerabilities (highest severity is: 9.8) - autoclosed #590

Closed mend-for-github-com[bot] closed 5 days ago

mend-for-github-com[bot] commented 1 month ago
Vulnerable Library - azure-identity-1.0.6.jar

This module contains client library for Microsoft Azure Identity.

Library home page: http://microsoft.com

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (azure-identity version) Remediation Possible** Reachability
CVE-2019-17195 Critical 9.8 nimbus-jose-jwt-6.0.1.jar Transitive 1.0.7 ✅
WS-2021-0419 High 7.7 gson-2.8.6.jar Transitive 1.0.9 ✅
CVE-2022-25647 High 7.7 gson-2.8.6.jar Transitive 1.0.9 ✅
CVE-2023-52428 High 7.5 nimbus-jose-jwt-6.0.1.jar Transitive 1.12.0 ✅
CVE-2023-1370 High 7.5 json-smart-2.3.jar Transitive 1.12.0 ✅
WS-2019-0379 Medium 6.5 commons-codec-1.11.jar Transitive 1.0.9 ✅
CVE-2021-27568 Medium 5.9 json-smart-2.3.jar Transitive 1.12.0 ✅
CVE-2024-35255 Medium 5.5 azure-identity-1.0.6.jar Direct 1.12.2 ✅
CVE-2022-21230 Medium 5.5 nanohttpd-2.3.1.jar Transitive N/A* ❌
WS-2017-3734 Medium 5.3 httpclient-4.5.jar Transitive 1.0.9 ✅
CVE-2020-13956 Medium 5.3 httpclient-4.5.jar Transitive 1.0.9 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-17195 ### Vulnerable Library - nimbus-jose-jwt-6.0.1.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: http://connect2id.com

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - oauth2-oidc-sdk-6.14.jar - :x: **nimbus-jose-jwt-6.0.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Publish Date: 2019-10-15

URL: CVE-2019-17195

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195

Release Date: 2019-10-15

Fix Resolution (com.nimbusds:nimbus-jose-jwt): 7.8.1

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.7

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2021-0419 ### Vulnerable Library - gson-2.8.6.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-processors/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - :x: **gson-2.8.6.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

### CVSS 3 Score Details (7.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-10-11

Fix Resolution (com.google.code.gson:gson): 2.8.9

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-25647 ### Vulnerable Library - gson-2.8.6.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-processors/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - :x: **gson-2.8.6.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Publish Date: 2022-05-01

URL: CVE-2022-25647

### CVSS 3 Score Details (7.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647`

Release Date: 2022-05-01

Fix Resolution (com.google.code.gson:gson): 2.8.9

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-52428 ### Vulnerable Library - nimbus-jose-jwt-6.0.1.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: http://connect2id.com

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - oauth2-oidc-sdk-6.14.jar - :x: **nimbus-jose-jwt-6.0.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Publish Date: 2024-02-11

URL: CVE-2023-52428

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428

Release Date: 2024-02-11

Fix Resolution (com.nimbusds:nimbus-jose-jwt): 9.37.2

Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-1370 ### Vulnerable Library - json-smart-2.3.jar

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.

Library home page: http://www.minidev.net/

Path to dependency file: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-service/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-nar/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-nar/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml,/nifi-nar-bundles/nifi-hadoop-libraries-bundle/nifi-hadoop-libraries-nar/pom.xml,/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml,/nifi-toolkit/nifi-toolkit-admin/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - oauth2-oidc-sdk-6.14.jar - :x: **json-smart-2.3.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Publish Date: 2023-03-13

URL: CVE-2023-1370

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/

Release Date: 2023-03-22

Fix Resolution (net.minidev:json-smart): 2.4.9

Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2019-0379 ### Vulnerable Library - commons-codec-1.11.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Library home page: https://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - :x: **commons-codec-1.11.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-05-20

Fix Resolution (commons-codec:commons-codec): 1.13

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-27568 ### Vulnerable Library - json-smart-2.3.jar

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.

Library home page: http://www.minidev.net/

Path to dependency file: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-service/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-nar/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-nar/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml,/nifi-nar-bundles/nifi-hadoop-libraries-bundle/nifi-hadoop-libraries-nar/pom.xml,/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml,/nifi-toolkit/nifi-toolkit-admin/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - oauth2-oidc-sdk-6.14.jar - :x: **json-smart-2.3.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.

Publish Date: 2021-02-23

URL: CVE-2021-27568

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-02-23

Fix Resolution (net.minidev:json-smart): 2.3.1

Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-35255 ### Vulnerable Library - azure-identity-1.0.6.jar

This module contains client library for Microsoft Azure Identity.

Library home page: http://microsoft.com

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml

Dependency Hierarchy: - :x: **azure-identity-1.0.6.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Publish Date: 2024-06-11

URL: CVE-2024-35255

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

Release Date: 2024-06-11

Fix Resolution: 1.12.2

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-21230 ### Vulnerable Library - nanohttpd-2.3.1.jar

NanoHttpd is a light-weight HTTP server designed for embedding in other applications.

Library home page: http://www.nanohttpd.org

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - :x: **nanohttpd-2.3.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. **Workaround:** Manually specifying the -Djava.io.tmpdir= argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue.

Publish Date: 2022-05-01

URL: CVE-2022-21230

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

WS-2017-3734 ### Vulnerable Library - httpclient-4.5.jar

Apache HttpComponents Client

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - :x: **httpclient-4.5.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2017-01-21

URL: WS-2017-3734

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2017-01-21

Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.3

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-13956 ### Vulnerable Library - httpclient-4.5.jar

Apache HttpComponents Client

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml

Dependency Hierarchy: - azure-identity-1.0.6.jar (Root Library) - msal4j-0.5.0-preview.jar - :x: **httpclient-4.5.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-12-02

Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.13

Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 5 days ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.