search

vaadin / platform

Vaadin platform 10+ is a Java web development platform based on Vaadin web components. If you don't know to which repository your bug report should be filed, use this and we'll move it to the right one.
https://vaadin.com
532 stars 78 forks source link

Vaadin 14 vulnerabilities #2787

Open aleuC opened 2 years ago

aleuC commented 2 years ago

Hi, we were analysing the vulnerabilities of our Vaadin 14 applications with the latest version (14.8.4) and these vulnerabilities related to vaadin dependencies were found:

[ERROR] ansi-html:0.0.7: CVE-2021-23424
[ERROR] ansi-regex:4.1.0: CVE-2021-3807
[ERROR] btoa:1.2.1: CWE-125: Out-of-bounds Read
[ERROR] faye-websocket:0.10.0: CVE-2020-15133
[ERROR] follow-redirects:1.14.1: CVE-2022-0536, CVE-2022-0155
[ERROR] glob-parent:3.1.0: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
[ERROR] highcharts:6.1.4: CVE-2021-29489, CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
[ERROR] jackson-databind-2.9.10.4.jar: CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-36180, CVE-2020-14195, CVE-2020-24616, CVE-2020-36182, CVE-2020-36181, CVE-2020-25649, CVE-2020-35491, CVE-2020-36184, CVE-2020-35490, CVE-2020-36183, CVE-2020-35728, CVE-2020-24750, CVE-2021-20190, CVE-2020-36186, CVE-2020-36185, CVE-2020-36188, CVE-2020-36187, CVE-2020-36179, CVE-2020-36189
[ERROR] tar:6.1.0: CVE-2021-32803, CVE-2021-32804, CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
[ERROR] url-parse:1.5.1: CVE-2021-3664, CVE-2022-0512
[ERROR] vaadin-board-2.2.0.jar: CVE-2011-0509
[ERROR] vaadin-charts-6.3.3.jar: CVE-2011-0509
[ERROR] vaadin-confirm-dialog-1.3.0.jar: CVE-2011-0509
[ERROR] vaadin-cookie-consent-1.2.0.jar: CVE-2011-0509
[ERROR] vaadin-crud-1.3.1.jar: CVE-2011-0509
[ERROR] vaadin-grid-pro-2.3.0.jar: CVE-2011-0509

did you know about them? how do you handle them? Thanks

samie commented 2 years ago

Hi, need to have a good look, but was this produced by dependency-check-maven? Unfortunately it also reports many false positives. E.g. CVE-2011-0509 is not applicable anything beyond Vaadin 6.