mend-for-github-com[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.kafka/kafka-clients/3.1.2/6b6e2cc01cd7e772296941aca74b2fff96e7c820/kafka-clients-3.1.2.jar
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-1471
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsSnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Publish Date: 2022-12-01
URL: CVE-2022-1471
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
Release Date: 2022-12-01
Fix Resolution: org.yaml:snakeyaml:2.0
CVE-2023-20873
### Vulnerable Library - spring-boot-actuator-autoconfigure-2.7.9.jarSpring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-actuator-autoconfigure/2.7.9/6f76c8a416d9f803e72fcead4b1683823ce6d663/spring-boot-actuator-autoconfigure-2.7.9.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-boot-actuator-autoconfigure-2.7.9.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsIn Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Publish Date: 2023-04-20
URL: CVE-2023-20873
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/security/cve-2023-20873
Release Date: 2023-04-20
Fix Resolution: org.springframework.boot:spring-boot-actuator-autoconfigure:2.7.11,3.0.6
CVE-2016-1000027
### Vulnerable Library - spring-web-5.3.25.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.3.25/c69815e7931cd3ce7f19cc8028fd1c36626120d6/spring-web-5.3.25.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-web-5.3.25.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsPivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data. Mend Note: After conducting further research, Mend has determined that all versions of spring-web up to version 6.0.0 are vulnerable to CVE-2016-1000027.
Publish Date: 2020-01-02
URL: CVE-2016-1000027
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-4wrc-f8pq-fpqp
Release Date: 2020-01-02
Fix Resolution: org.springframework:spring-web:6.0.0
CVE-2022-25857
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsThe package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
Publish Date: 2022-08-30
URL: CVE-2022-25857
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857
Release Date: 2022-08-30
Fix Resolution: org.yaml:snakeyaml:1.31
CVE-2023-1370
### Vulnerable Library - json-smart-2.4.8.jarJSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
Library home page: https://urielch.github.io/
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/net.minidev/json-smart/2.4.8/7c62f5f72ab05eb54d40e2abf0360a2fe9ea477f/json-smart-2.4.8.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **json-smart-2.4.8.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability Details[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
Publish Date: 2023-03-22
URL: CVE-2023-1370
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
Release Date: 2023-03-22
Fix Resolution: net.minidev:json-smart:2.4.9
CVE-2023-28709
### Vulnerable Library - tomcat-embed-core-9.0.71.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.71/adaed61b4eaa5b52448336c0881fcd828fd51a2f/tomcat-embed-core-9.0.71.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **tomcat-embed-core-9.0.71.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsThe fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Publish Date: 2023-05-22
URL: CVE-2023-28709
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j
Release Date: 2023-05-22
Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:8.5.88,9.0.74,10.1.8 ,11.0.0-M5;org.apache.tomcat:tomcat-coyote:8.5.88,9.0.74,10.1.8 ,11.0.0-M5
CVE-2023-20883
### Vulnerable Library - spring-boot-autoconfigure-2.7.9.jarSpring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/2.7.9/849b238dd024101cad8d107b4a8b0906f75003d5/spring-boot-autoconfigure-2.7.9.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-boot-autoconfigure-2.7.9.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsIn Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Publish Date: 2023-05-26
URL: CVE-2023-20883
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/security/cve-2023-20883
Release Date: 2023-05-26
Fix Resolution: org.springframework.boot:spring-boot-autoconfigure:2.5.12,2.6.12,2.7.12,3.0.7
CVE-2023-20860
### Vulnerable Library - spring-webmvc-5.3.25.jarSpring Web MVC
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.25/62a8258bcc4f7a58dd69af5140481b64653c90/spring-webmvc-5.3.25.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-webmvc-5.3.25.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsSpring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Publish Date: 2023-03-27
URL: CVE-2023-20860
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/blog/2023/03/21/this-week-in-spring-march-21st-2023/
Release Date: 2023-03-27
Fix Resolution: org.springframework:spring-webmvc:5.3.26,6.0.7
CVE-2023-25194
### Vulnerable Library - kafka-clients-3.1.2.jarLibrary home page: https://kafka.apache.org
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.kafka/kafka-clients/3.1.2/6b6e2cc01cd7e772296941aca74b2fff96e7c820/kafka-clients-3.1.2.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **kafka-clients-3.1.2.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsA possible security vulnerability has been identified in Apache Kafka Connect. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
Publish Date: 2023-02-07
URL: CVE-2023-25194
### CVSS 3 Score Details (6.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://kafka.apache.org/cve-list
Release Date: 2023-02-07
Fix Resolution: org.apache.kafka:kafka-clients:3.4.0
CVE-2022-41854
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsThose using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
Publish Date: 2022-11-11
URL: CVE-2022-41854
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/531/
Release Date: 2022-11-11
Fix Resolution: org.yaml:snakeyaml:1.32
CVE-2023-34462
### Vulnerable Library - netty-handler-4.1.89.Final.jarLibrary home page: https://netty.io/
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.netty/netty-handler/4.1.89.Final/ced584e9eba5a6b7aad7c6a28a60c13375459f1a/netty-handler-4.1.89.Final.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **netty-handler-4.1.89.Final.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsNetty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
Publish Date: 2023-06-22
URL: CVE-2023-34462
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-6mjq-h674-j845
Release Date: 2023-06-07
Fix Resolution: io.netty:netty-handler:4.1.94.Final;io.netty:netty-all:4.1.94.Final
CVE-2023-20861
### Vulnerable Library - spring-expression-5.3.25.jarSpring Expression Language (SpEL)
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.3.25/d681cdb86611f03d8ef29654edde219fe5afef1d/spring-expression-5.3.25.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-expression-5.3.25.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsIn Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Publish Date: 2023-03-23
URL: CVE-2023-20861
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/security/cve-2023-20861
Release Date: 2023-03-23
Fix Resolution: org.springframework:spring-expression:x5.2.23.RELEASE,5.3.26,6.0.7
CVE-2022-38752
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsUsing snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Publish Date: 2022-09-05
URL: CVE-2022-38752
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-9w3m-gqgf-c4p9
Release Date: 2022-09-05
Fix Resolution: org.yaml:snakeyaml:1.32
CVE-2022-38751
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsUsing snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Publish Date: 2022-09-05
URL: CVE-2022-38751
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039
Release Date: 2022-09-05
Fix Resolution: org.yaml:snakeyaml:1.31
CVE-2023-20863
### Vulnerable Library - spring-expression-5.3.25.jarSpring Expression Language (SpEL)
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.3.25/d681cdb86611f03d8ef29654edde219fe5afef1d/spring-expression-5.3.25.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **spring-expression-5.3.25.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsIn spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Publish Date: 2023-04-13
URL: CVE-2023-20863
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/security/cve-2023-20863
Release Date: 2023-04-13
Fix Resolution: org.springframework:spring-expression - 5.2.24.RELEASE,5.3.27,6.0.8
CVE-2022-38749
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsUsing snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Publish Date: 2022-09-05
URL: CVE-2022-38749
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027
Release Date: 2022-09-05
Fix Resolution: org.yaml:snakeyaml:1.31
CVE-2022-38750
### Vulnerable Library - snakeyaml-1.30.jarYAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.30/8fde7fe2586328ac3c68db92045e1c8759125000/snakeyaml-1.30.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **snakeyaml-1.30.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsUsing snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Publish Date: 2022-09-05
URL: CVE-2022-38750
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027
Release Date: 2022-09-05
Fix Resolution: org.yaml:snakeyaml:1.31
CVE-2023-2976
### Vulnerable Library - guava-31.1-jre.jarGuava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - temporal-spring-boot-autoconfigure-alpha-1.20.0.jar - temporal-opentracing-1.20.0.jar - :x: **guava-31.1-jre.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsUse of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Publish Date: 2023-06-14
URL: CVE-2023-2976
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-2976
Release Date: 2023-06-14
Fix Resolution: com.google.guava:guava:32.0.1-jre,com.google.guava:guava:32.0.1-android
CVE-2023-28708
### Vulnerable Library - tomcat-embed-core-9.0.71.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /springboot/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.71/adaed61b4eaa5b52448336c0881fcd828fd51a2f/tomcat-embed-core-9.0.71.jar
Dependency Hierarchy: - temporal-spring-boot-starter-alpha-1.20.0.jar (Root Library) - spring-boot-dependencies-2.7.9.pom - :x: **tomcat-embed-core-9.0.71.jar** (Vulnerable Library)
Found in HEAD commit: d1f41eda6460bd64723372d4bca528a95a4c1078
Found in base branch: main
### Vulnerability DetailsWhen using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Publish Date: 2023-03-22
URL: CVE-2023-28708
### CVSS 3 Score Details (4.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
Release Date: 2023-03-22
Fix Resolution: org.apache.tomcat:tomcat-catalina:8.5.86,9.0.72,10.1.6;org.apache.tomcat.embed/tomcat-embed-core:8.5.86,9.0.72,10.1.6