Code Monkey home page Code Monkey logo

refugeelink's Introduction

RefugeeLink by KOSASIH is licensed under Attribution 4.0 International

RefugeeLink Microservice

Welcome to RefugeeLink, a powerful microservice aimed at facilitating the integration of refugees into host communities. This project aims to connect refugees with local support networks, essential resources, and meaningful employment opportunities, ultimately contributing to a successful and harmonious integration process.

Description

RefugeeLink is a transformative microservice designed to bridge the gap between refugees and their new host communities. By seamlessly connecting refugees with local support networks, vital resources, and promising employment opportunities, RefugeeLink paves the way for a successful and harmonious integration process. Our platform fosters a sense of belonging, empowerment, and collaboration, facilitating the journey towards a brighter future for both refugees and their welcoming communities.

Table of Contents

Introduction

RefugeeLink is a microservice designed to address the challenges faced by refugees during their integration journey. By leveraging modern technology and innovative approaches, RefugeeLink aims to empower refugees to connect with local communities, access vital resources, and find meaningful employment opportunities.

Features

  • Community Connection: RefugeeLink provides a platform for refugees to connect with local support networks, community organizations, and fellow refugees, fostering a sense of belonging and collaboration.

  • Resource Access: Our microservice offers a streamlined way for refugees to access essential resources such as housing, healthcare, education, legal assistance, and more.

  • Employment Opportunities: RefugeeLink matches refugees with suitable employment opportunities based on their skills, experience, and aspirations, contributing to their economic empowerment.

  • User-Friendly Interface: The intuitive user interface ensures easy navigation and a seamless experience for both refugees and community partners.

Getting Started

Prerequisites

Before you begin, ensure you have met the following requirements:

Installation

  1. Clone the repository:

    git clone https://github.com/KOSASIH/RefugeeLink.git
    cd RefugeeLink
  2. Install dependencies:

    npm install
  3. Set up environment variables: Create a .env file in the project root and add the following:

    DATABASE_URL=mongodb://localhost:27017/refugeelink
    PORT=3000
    
  4. Start the server:

    npm start

Usage

  1. Access the RefugeeLink microservice through the provided API endpoints.
  2. Refugees can create accounts, update their profiles, and explore community resources.
  3. Community partners can register, post employment opportunities, and engage with refugees.

API Documentation

For detailed API documentation and usage examples, please refer to API Documentation.

Contributing

We welcome contributions from the community! To contribute to RefugeeLink, please follow these steps:

  1. Fork the repository.
  2. Create a new branch for your feature: git checkout -b feature-name.
  3. Commit your changes: git commit -m 'Add feature'.
  4. Push to the branch: git push origin feature-name.
  5. Create a pull request.

License

This project is licensed under the MIT License.


Empower refugees and support their successful integration into host communities with RefugeeLink. Together, we can create a more inclusive and welcoming world.

Project Structure

Node is required for generation and recommended for development. package.json is always generated for a better development experience with prettier, commit hooks, scripts and so on.

In the project root, JHipster generates configuration files for tools like git, prettier, eslint, husky, and others that are well known and you can find references in the web.

/src/* structure follows default Java structure.

  • .yo-rc.json - Yeoman configuration file JHipster configuration is stored in this file at generator-jhipster key. You may find generator-jhipster-* for specific blueprints configuration.

  • .yo-resolve (optional) - Yeoman conflict resolver Allows to use a specific action when conflicts are found skipping prompts for files that matches a pattern. Each line should match [pattern] [action] with pattern been a Minimatch pattern and action been one of skip (default if ommited) or force. Lines starting with # are considered comments and are ignored.

  • .jhipster/*.json - JHipster entity configuration files

  • npmw - wrapper to use locally installed npm. JHipster installs Node and npm locally using the build tool by default. This wrapper makes sure npm is installed locally and uses it avoiding some differences different versions can cause. By using ./npmw instead of the traditional npm you can configure a Node-less environment to develop or test your application.

  • /src/main/docker - Docker configurations for the application and services that the application depends on

Development

Before you can build this project, you must install and configure the following dependencies on your machine:

  1. Node.js: We use Node to run a development web server and build the project. Depending on your system, you can install Node either from source or as a pre-packaged bundle.

After installing Node, you should be able to run the following command to install development tools. You will only need to run this command when dependencies change in package.json.

npm install

We use npm scripts and Angular CLI with Webpack as our build system.

Run the following commands in two separate terminals to create a blissful development experience where your browser auto-refreshes when files change on your hard drive.

./mvnw
npm start

Npm is also used to manage CSS and JavaScript dependencies used in this application. You can upgrade dependencies by specifying a newer version in package.json. You can also run npm update and npm install to manage dependencies. Add the help flag on any command to see how you can use it. For example, npm help update.

The npm run command will list all of the scripts available to run for this project.

PWA Support

JHipster ships with PWA (Progressive Web App) support, and it's turned off by default. One of the main components of a PWA is a service worker.

The service worker initialization code is disabled by default. To enable it, uncomment the following code in src/main/webapp/app/app.module.ts:

ServiceWorkerModule.register('ngsw-worker.js', { enabled: false }),

Managing dependencies

For example, to add Leaflet library as a runtime dependency of your application, you would run following command:

npm install --save --save-exact leaflet

To benefit from TypeScript type definitions from DefinitelyTyped repository in development, you would run following command:

npm install --save-dev --save-exact @types/leaflet

Then you would import the JS and CSS files specified in library's installation instructions so that Webpack knows about them: Edit src/main/webapp/app/app.module.ts file:

import 'leaflet/dist/leaflet.js';

Edit src/main/webapp/content/scss/vendor.scss file:

@import 'leaflet/dist/leaflet.css';

Note: There are still a few other things remaining to do for Leaflet that we won't detail here.

For further instructions on how to develop with JHipster, have a look at Using JHipster in development.

Developing Microfrontend

Microservices doesn't contain every required backend feature to allow microfrontends to run alone. You must start a pre-built gateway version or from source.

Start gateway from source:

cd gateway
npm run docker:db:up # start database if necessary
npm run docker:others:up # start service discovery and authentication service if necessary
npm run app:start # alias for ./(mvnw|gradlew)

Microfrontend's build-watch script is configured to watch and compile microfrontend's sources and synchronizes with gateway's frontend. Start it using:

cd microfrontend
npm run docker:db:up # start database if necessary
npm run build-watch

It's possible to run microfrontend's frontend standalone using:

cd microfrontend
npm run docker:db:up # start database if necessary
npm watch # alias for `npm start` and `npm run backend:start` in parallel

Using Angular CLI

You can also use Angular CLI to generate some custom client code.

For example, the following command:

ng generate component my-component

will generate few files:

create src/main/webapp/app/my-component/my-component.component.html
create src/main/webapp/app/my-component/my-component.component.ts
update src/main/webapp/app/app.module.ts

JHipster Control Center

JHipster Control Center can help you manage and control your application(s). You can start a local control center server (accessible on http://localhost:7419) with:

docker compose -f src/main/docker/jhipster-control-center.yml up

OAuth 2.0 / OpenID Connect

Congratulations! You've selected an excellent way to secure your JHipster application. If you're not sure what OAuth and OpenID Connect (OIDC) are, please see What the Heck is OAuth?

To log in to your app, you'll need to have Keycloak up and running. The JHipster Team has created a Docker container for you that has the default users and roles. Start Keycloak using the following command.

docker compose -f src/main/docker/keycloak.yml up

The security settings in src/main/resources/config/application.yml are configured for this image.

spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: http://localhost:9080/realms/jhipster
        registration:
          oidc:
            client-id: web_app
            client-secret: web_app
            scope: openid,profile,email

Some of Keycloak configuration is now done in build time and the other part before running the app, here is the list of all build and configuration options.

Before moving to production, please make sure to follow this guide for better security and performance.

Also, you should never use start-dev nor KC_DB=dev-file in production.

When using Kubernetes, importing should be done using init-containers (with a volume when using db=dev-file).

Okta

If you'd like to use Okta instead of Keycloak, it's pretty quick using the Okta CLI. After you've installed it, run:

okta register

Then, in your JHipster app's directory, run okta apps create and select JHipster. This will set up an Okta app for you, create ROLE_ADMIN and ROLE_USER groups, create a .okta.env file with your Okta settings, and configure a groups claim in your ID token.

Run source .okta.env and start your app with Maven or Gradle. You should be able to sign in with the credentials you registered with.

If you're on Windows, you should install WSL so the source command will work.

If you'd like to configure things manually through the Okta developer console, see the instructions below.

First, you'll need to create a free developer account at https://developer.okta.com/signup/. After doing so, you'll get your own Okta domain, that has a name like https://dev-123456.okta.com.

Modify src/main/resources/config/application.yml to use your Okta settings.

spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: https://{yourOktaDomain}/oauth2/default
        registration:
          oidc:
            client-id: {clientId}
            client-secret: {clientSecret}
security:

Create an OIDC App in Okta to get a {clientId} and {clientSecret}. To do this, log in to your Okta Developer account and navigate to Applications > Add Application. Click Web and click the Next button. Give the app a name you’ll remember, specify http://localhost:8080 as a Base URI, and http://localhost:8080/login/oauth2/code/oidc as a Login Redirect URI. Click Done, then Edit and add http://localhost:8080 as a Logout redirect URI. Copy and paste the client ID and secret into your application.yml file.

Create a ROLE_ADMIN and ROLE_USER group and add users into them. Modify e2e tests to use this account when running integration tests. You'll need to change credentials in src/test/javascript/e2e/account/account.spec.ts and src/test/javascript/e2e/admin/administration.spec.ts.

Navigate to API > Authorization Servers, click the Authorization Servers tab and edit the default one. Click the Claims tab and Add Claim. Name it "groups", and include it in the ID Token. Set the value type to "Groups" and set the filter to be a Regex of .*.

After making these changes, you should be good to go! If you have any issues, please post them to Stack Overflow. Make sure to tag your question with "jhipster" and "okta".

Auth0

If you'd like to use Auth0 instead of Keycloak, follow the configuration steps below:

  • Create a free developer account at https://auth0.com/signup. After successful sign-up, your account will be associated with a unique domain like dev-xxx.us.auth0.com
  • Create a new application of type Regular Web Applications. Switch to the Settings tab, and configure your application settings like:
    • Allowed Callback URLs: http://localhost:8080/login/oauth2/code/oidc
    • Allowed Logout URLs: http://localhost:8080/
  • Navigate to User Management > Roles and create new roles named ROLE_ADMIN, and ROLE_USER.
  • Navigate to User Management > Users and create a new user account. Click on the Role tab to assign roles to the newly created user account.
  • Navigate to Auth Pipeline > Rules and create a new Rule. Choose Empty rule template. Provide a meaningful name like JHipster claims and replace Script content with the following and Save.
function (user, context, callback) {
  user.preferred_username = user.email;
  const roles = (context.authorization || {}).roles;

  function prepareCustomClaimKey(claim) {
    return `https://www.jhipster.tech/${claim}`;
  }

  const rolesClaim = prepareCustomClaimKey('roles');

  if (context.idToken) {
    context.idToken[rolesClaim] = roles;
  }

  if (context.accessToken) {
    context.accessToken[rolesClaim] = roles;
  }

  callback(null, user, context);
}
  • In your JHipster application, modify src/main/resources/config/application.yml to use your Auth0 application settings:
spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            # make sure to include the ending slash!
            issuer-uri: https://{your-auth0-domain}/
        registration:
          oidc:
            client-id: {clientId}
            client-secret: {clientSecret}
            scope: openid,profile,email
jhipster:
  ...
  security:
    oauth2:
      audience:
        - https://{your-auth0-domain}/api/v2/

Doing API-First development using openapi-generator-cli

OpenAPI-Generator is configured for this application. You can generate API code from the src/main/resources/swagger/api.yml definition file by running:

./mvnw generate-sources

Then implements the generated delegate classes with @Service classes.

To edit the api.yml definition file, you can use a tool such as Swagger-Editor. Start a local instance of the swagger-editor using docker by running: docker compose -f src/main/docker/swagger-editor.yml up -d. The editor will then be reachable at http://localhost:7742.

Refer to Doing API-First development for more details.

Building for production

Packaging as jar

To build the final jar and optimize the RefugeeLink application for production, run:

./mvnw -Pprod clean verify

This will concatenate and minify the client CSS and JavaScript files. It will also modify index.html so it references these new files. To ensure everything worked, run:

java -jar target/*.jar

Then navigate to http://localhost:8081 in your browser.

Refer to Using JHipster in production for more details.

Packaging as war

To package your application as a war in order to deploy it to an application server, run:

./mvnw -Pprod,war clean verify

Testing

To launch your application's tests, run:

./mvnw verify

Client tests

Unit tests are run by Jest. They're located in src/test/javascript/ and can be run with:

npm test

Other tests

Performance tests are run by Gatling and written in Scala. They're located in src/test/java/gatling/simulations.

You can execute all Gatling tests with

./mvnw gatling:test

For more information, refer to the Running tests page.

Code quality

Sonar is used to analyse code quality. You can start a local Sonar server (accessible on http://localhost:9001) with:

docker compose -f src/main/docker/sonar.yml up -d

Note: we have turned off forced authentication redirect for UI in src/main/docker/sonar.yml for out of the box experience while trying out SonarQube, for real use cases turn it back on.

You can run a Sonar analysis with using the sonar-scanner or by using the maven plugin.

Then, run a Sonar analysis:

./mvnw -Pprod clean verify sonar:sonar -Dsonar.login=admin -Dsonar.password=admin

If you need to re-run the Sonar phase, please be sure to specify at least the initialize phase since Sonar properties are loaded from the sonar-project.properties file.

./mvnw initialize sonar:sonar -Dsonar.login=admin -Dsonar.password=admin

Additionally, Instead of passing sonar.password and sonar.login as CLI arguments, these parameters can be configured from sonar-project.properties as shown below:

sonar.login=admin
sonar.password=admin

For more information, refer to the Code quality page.

Using Docker to simplify development (optional)

You can use Docker to improve your JHipster development experience. A number of docker-compose configuration are available in the src/main/docker folder to launch required third party services.

For example, to start a postgresql database in a docker container, run:

docker compose -f src/main/docker/postgresql.yml up -d

To stop it and remove the container, run:

docker compose -f src/main/docker/postgresql.yml down

You can also fully dockerize your application and all the services that it depends on. To achieve this, first build a docker image of your app by running:

npm run java:docker

Or build a arm64 docker image when using an arm64 processor os like MacOS with M1 processor family running:

npm run java:docker:arm64

Then run:

docker compose -f src/main/docker/app.yml up -d

When running Docker Desktop on MacOS Big Sur or later, consider enabling experimental Use the new Virtualization framework for better processing performance (disk access performance is worse).

For more information refer to Using Docker and Docker-Compose, this page also contains information on the docker-compose sub-generator (jhipster docker-compose), which is able to generate docker configurations for one or several JHipster applications.

Continuous Integration (optional)

To configure CI for your project, run the ci-cd sub-generator (jhipster ci-cd), this will let you generate configuration files for a number of Continuous Integration systems. Consult the Setting up Continuous Integration page for more information.

RefugeeLink by KOSASIH is licensed under Attribution 4.0 International

refugeelink's People

Contributors

jhipster-bot avatar kosasih avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar  avatar

refugeelink's Issues

spring-cloud-starter-stream-kafka-4.0.3.jar: 6 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - spring-cloud-starter-stream-kafka-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/cloud/spring-cloud-function-context/4.0.3/spring-cloud-function-context-4.0.3.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter-stream-kafka version) Remediation Possible**
CVE-2023-34040 High 7.8 spring-kafka-3.0.8.jar Transitive 4.0.5
CVE-2023-43642 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34455 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34454 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34453 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2024-22271 Medium 6.5 spring-cloud-function-context-4.0.3.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34040

Vulnerable Library - spring-kafka-3.0.8.jar

Spring Kafka Support

Library home page: https://github.com/spring-projects/spring-kafka

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/kafka/spring-kafka/3.0.8/spring-kafka-3.0.8.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-integration-kafka-6.0.4.jar
          • spring-kafka-3.0.8.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

Specifically, an application is vulnerable when all of the following are true:

  • The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record
  • The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.
  • The user allows untrusted sources to publish to a Kafka topic

By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.

Publish Date: 2023-08-24

URL: CVE-2023-34040

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34040

Release Date: 2023-08-24

Fix Resolution (org.springframework.kafka:spring-kafka): 3.0.10

Direct dependency fix Resolution (org.springframework.cloud:spring-cloud-starter-stream-kafka): 4.0.5

Step up your Open Source Security Game with Mend here

CVE-2023-43642

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-integration-kafka-6.0.4.jar
          • spring-kafka-3.0.8.jar
            • kafka-clients-3.4.1.jar
              • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit 9f8c3cf74 which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Publish Date: 2023-09-25

URL: CVE-2023-43642

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-55g7-9cwv-5qfv

Release Date: 2023-09-25

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.4

Step up your Open Source Security Game with Mend here

CVE-2023-34455

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-integration-kafka-6.0.4.jar
          • spring-kafka-3.0.8.jar
            • kafka-clients-3.4.1.jar
              • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1.

The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk.

In the case that the compressed variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the chunkSize variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a java.lang.NegativeArraySizeException exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal java.lang.OutOfMemoryError error.

Version 1.1.10.1 contains a patch for this issue.

Publish Date: 2023-06-15

URL: CVE-2023-34455

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qcwq-55hx-v3vh

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2023-34454

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-integration-kafka-6.0.4.jar
          • spring-kafka-3.0.8.jar
            • kafka-clients-3.4.1.jar
              • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.

The function compress(char[] input) in the file Snappy.java receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.

Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.

Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a java.lang.NegativeArraySizeException exception will be raised while trying to allocate the array buf. On the other side, if the result is positive, the buf array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.

The same issue exists also when using the compress functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

Version 1.1.10.1 contains a patch for this issue.

Publish Date: 2023-06-15

URL: CVE-2023-34454

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fjpj-2g6w-x25r

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2023-34453

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-integration-kafka-6.0.4.jar
          • spring-kafka-3.0.8.jar
            • kafka-clients-3.4.1.jar
              • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.

The function shuffle(int[] input) in the file BitShuffle.java receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a java.lang.NegativeArraySizeException exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as java.lang.ArrayIndexOutOfBoundsException.

The same issue exists also when using the shuffle functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.

Version 1.1.10.1 contains a patch for this vulnerability.

Publish Date: 2023-06-15

URL: CVE-2023-34453

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pqr6-cmr2-h8hf

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2024-22271

Vulnerable Library - spring-cloud-function-context-4.0.3.jar

Implementation of core API for Spring Cloud Function

Library home page: https://spring.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/cloud/spring-cloud-function-context/4.0.3/spring-cloud-function-context-4.0.3.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-cloud-stream-binder-kafka-core-4.0.3.jar
        • spring-cloud-stream-4.0.3.jar
          • spring-cloud-function-context-4.0.3.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.

Publish Date: 2024-01-08

URL: CVE-2024-22271

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22271

Release Date: 2024-01-08

Fix Resolution: org.springframework.cloud:spring-cloud-function-context:4.1.2

Step up your Open Source Security Game with Mend here

spring-cloud-starter-4.0.3.jar: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter version) Remediation Possible**
CVE-2024-29857 High 7.5 bcprov-jdk15on-1.69.jar Transitive N/A*
CVE-2024-30172 Medium 5.9 bcprov-jdk15on-1.69.jar Transitive N/A*
CVE-2023-33202 Medium 5.5 bcprov-jdk15on-1.69.jar Transitive N/A*
CVE-2023-33201 Medium 5.3 bcprov-jdk15on-1.69.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-29857

Vulnerable Library - bcprov-jdk15on-1.69.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

Library home page: https://www.bouncycastle.org/java.html

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Dependency Hierarchy:

  • spring-cloud-starter-4.0.3.jar (Root Library)
    • spring-security-rsa-1.0.11.RELEASE.jar
      • bcpkix-jdk15on-1.69.jar
        • bcprov-jdk15on-1.69.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Publish Date: 2024-05-09

URL: CVE-2024-29857

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.bouncycastle.org/latest_releases.html

Release Date: 2024-05-09

Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78

Step up your Open Source Security Game with Mend here

CVE-2024-30172

Vulnerable Library - bcprov-jdk15on-1.69.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

Library home page: https://www.bouncycastle.org/java.html

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Dependency Hierarchy:

  • spring-cloud-starter-4.0.3.jar (Root Library)
    • spring-security-rsa-1.0.11.RELEASE.jar
      • bcpkix-jdk15on-1.69.jar
        • bcprov-jdk15on-1.69.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Publish Date: 2024-05-14

URL: CVE-2024-30172

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2024-30172

Release Date: 2024-03-24

Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78

Step up your Open Source Security Game with Mend here

CVE-2023-33202

Vulnerable Library - bcprov-jdk15on-1.69.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

Library home page: https://www.bouncycastle.org/java.html

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Dependency Hierarchy:

  • spring-cloud-starter-4.0.3.jar (Root Library)
    • spring-security-rsa-1.0.11.RELEASE.jar
      • bcpkix-jdk15on-1.69.jar
        • bcprov-jdk15on-1.69.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)

Publish Date: 2023-11-23

URL: CVE-2023-33202

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wjxj-5m7g-mg7q

Release Date: 2023-11-23

Fix Resolution: org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73

Step up your Open Source Security Game with Mend here

CVE-2023-33201

Vulnerable Library - bcprov-jdk15on-1.69.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

Library home page: https://www.bouncycastle.org/java.html

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Dependency Hierarchy:

  • spring-cloud-starter-4.0.3.jar (Root Library)
    • spring-security-rsa-1.0.11.RELEASE.jar
      • bcpkix-jdk15on-1.69.jar
        • bcprov-jdk15on-1.69.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Publish Date: 2023-07-05

URL: CVE-2023-33201

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-07-05

Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74

Step up your Open Source Security Game with Mend here

jhipster-framework-8.0.0-beta.2.jar: 5 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - jhipster-framework-8.0.0-beta.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.4.8/logback-core-1.4.8.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jhipster-framework version) Remediation Possible**
CVE-2022-1471 Critical 9.8 snakeyaml-1.33.jar Transitive 8.1.0
CVE-2023-6481 High 7.5 logback-core-1.4.8.jar Transitive 8.2.0
CVE-2023-6378 High 7.5 logback-classic-1.4.8.jar Transitive 8.2.0
CVE-2023-34055 Medium 6.5 spring-boot-3.1.1.jar Transitive 8.1.0
CVE-2023-20863 Medium 6.5 spring-expression-6.0.7.jar Transitive 8.0.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-1471

Vulnerable Library - snakeyaml-1.33.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar

Dependency Hierarchy:

  • jhipster-framework-8.0.0-beta.2.jar (Root Library)
    • spring-boot-starter-validation-3.1.1.jar
      • spring-boot-starter-3.1.1.jar
        • snakeyaml-1.33.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Publish Date: 2022-12-01

URL: CVE-2022-1471

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374

Release Date: 2022-12-01

Fix Resolution (org.yaml:snakeyaml): 2.0

Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.1.0

Step up your Open Source Security Game with Mend here

CVE-2023-6481

Vulnerable Library - logback-core-1.4.8.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.4.8/logback-core-1.4.8.jar

Dependency Hierarchy:

  • jhipster-framework-8.0.0-beta.2.jar (Root Library)
    • spring-boot-starter-validation-3.1.1.jar
      • spring-boot-starter-3.1.1.jar
        • spring-boot-starter-logging-3.1.1.jar
          • logback-classic-1.4.8.jar
            • logback-core-1.4.8.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution (ch.qos.logback:logback-core): 1.4.14

Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.2.0

Step up your Open Source Security Game with Mend here

CVE-2023-6378

Vulnerable Library - logback-classic-1.4.8.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.4.8/logback-classic-1.4.8.jar

Dependency Hierarchy:

  • jhipster-framework-8.0.0-beta.2.jar (Root Library)
    • spring-boot-starter-validation-3.1.1.jar
      • spring-boot-starter-3.1.1.jar
        • spring-boot-starter-logging-3.1.1.jar
          • logback-classic-1.4.8.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution (ch.qos.logback:logback-classic): 1.4.12

Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.2.0

Step up your Open Source Security Game with Mend here

CVE-2023-34055

Vulnerable Library - spring-boot-3.1.1.jar

Spring Boot

Library home page: https://spring.io/projects/spring-boot

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot/3.1.1/spring-boot-3.1.1.jar

Dependency Hierarchy:

  • jhipster-framework-8.0.0-beta.2.jar (Root Library)
    • spring-boot-starter-validation-3.1.1.jar
      • spring-boot-starter-3.1.1.jar
        • spring-boot-3.1.1.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  • the application uses Spring MVC or Spring WebFlux
  • org.springframework.boot:spring-boot-actuator is on the classpath

Publish Date: 2023-11-28

URL: CVE-2023-34055

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34055

Release Date: 2023-11-28

Fix Resolution (org.springframework.boot:spring-boot): 3.1.6

Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.1.0

Step up your Open Source Security Game with Mend here

CVE-2023-20863

Vulnerable Library - spring-expression-6.0.7.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/6.0.7/spring-expression-6.0.7.jar

Dependency Hierarchy:

  • jhipster-framework-8.0.0-beta.2.jar (Root Library)
    • spring-context-support-6.0.7.jar
      • spring-context-6.0.7.jar
        • spring-expression-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-04-13

URL: CVE-2023-20863

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20863

Release Date: 2023-04-13

Fix Resolution (org.springframework:spring-expression): 6.0.8

Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.0.0

Step up your Open Source Security Game with Mend here

spring-boot-loader-tools-3.1.1.jar: 2 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - spring-boot-loader-tools-3.1.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-loader-tools version) Remediation Possible**
CVE-2024-26308 Medium 5.5 commons-compress-1.21.jar Transitive N/A*
CVE-2024-25710 Medium 5.5 commons-compress-1.21.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-26308

Vulnerable Library - commons-compress-1.21.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: https://commons.apache.org/proper/commons-compress/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Dependency Hierarchy:

  • spring-boot-loader-tools-3.1.1.jar (Root Library)
    • commons-compress-1.21.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

Publish Date: 2024-02-19

URL: CVE-2024-26308

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26308

Release Date: 2024-02-19

Fix Resolution: org.apache.commons:commons-compress:1.26.0

Step up your Open Source Security Game with Mend here

CVE-2024-25710

Vulnerable Library - commons-compress-1.21.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: https://commons.apache.org/proper/commons-compress/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Dependency Hierarchy:

  • spring-boot-loader-tools-3.1.1.jar (Root Library)
    • commons-compress-1.21.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Publish Date: 2024-02-19

URL: CVE-2024-25710

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-25710

Release Date: 2024-02-19

Fix Resolution: org.apache.commons:commons-compress:1.26.0

Step up your Open Source Security Game with Mend here

spring-boot-starter-oauth2-client-3.1.1.jar: 5 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - spring-boot-starter-oauth2-client-3.1.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/6.0.2/spring-security-core-6.0.2.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-oauth2-client version) Remediation Possible**
CVE-2023-34034 Critical 9.8 spring-security-config-6.0.2.jar Transitive 3.1.2
CVE-2024-22257 High 8.2 spring-security-core-6.0.2.jar Transitive 3.1.10
CVE-2023-52428 High 7.5 nimbus-jose-jwt-9.24.4.jar Transitive 3.3.0
CVE-2023-20862 Medium 6.3 spring-security-web-6.0.2.jar Transitive 3.1.2
CVE-2023-34035 Medium 5.3 spring-security-config-6.0.2.jar Transitive 3.1.2

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34034

Vulnerable Library - spring-security-config-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.2/spring-security-config-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-client-3.1.1.jar (Root Library)
    • spring-security-config-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.

Publish Date: 2023-07-19

URL: CVE-2023-34034

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34034

Release Date: 2023-07-19

Fix Resolution (org.springframework.security:spring-security-config): 6.0.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.1.2

Step up your Open Source Security Game with Mend here

CVE-2024-22257

Vulnerable Library - spring-security-core-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/6.0.2/spring-security-core-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-client-3.1.1.jar (Root Library)
    • spring-security-config-6.0.2.jar
      • spring-security-core-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Publish Date: 2024-03-18

URL: CVE-2024-22257

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22257

Release Date: 2024-03-18

Fix Resolution (org.springframework.security:spring-security-core): 6.1.8

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.1.10

Step up your Open Source Security Game with Mend here

CVE-2023-52428

Vulnerable Library - nimbus-jose-jwt-9.24.4.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/nimbusds/nimbus-jose-jwt/9.24.4/nimbus-jose-jwt-9.24.4.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-client-3.1.1.jar (Root Library)
    • spring-security-oauth2-client-6.0.2.jar
      • oauth2-oidc-sdk-9.43.1.jar
        • nimbus-jose-jwt-9.24.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Publish Date: 2024-02-11

URL: CVE-2023-52428

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428

Release Date: 2024-02-11

Fix Resolution (com.nimbusds:nimbus-jose-jwt): 9.37.2

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.3.0

Step up your Open Source Security Game with Mend here

CVE-2023-20862

Vulnerable Library - spring-security-web-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/6.0.2/spring-security-web-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-client-3.1.1.jar (Root Library)
    • spring-security-oauth2-client-6.0.2.jar
      • spring-security-web-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Publish Date: 2023-04-19

URL: CVE-2023-20862

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20862

Release Date: 2023-04-19

Fix Resolution (org.springframework.security:spring-security-web): 6.0.3

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.1.2

Step up your Open Source Security Game with Mend here

CVE-2023-34035

Vulnerable Library - spring-security-config-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.2/spring-security-config-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-client-3.1.1.jar (Root Library)
    • spring-security-config-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

  • Spring MVC is on the classpath
  • Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
  • The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints

An application is not vulnerable if any of the following is true:

  • The application does not have Spring MVC on the classpath
  • The application secures no servlets other than Spring MVC’s DispatcherServlet
  • The application uses requestMatchers(String) only for Spring MVC endpoints

Publish Date: 2023-07-18

URL: CVE-2023-34035

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4vpr-xfrp-cj64

Release Date: 2023-07-18

Fix Resolution (org.springframework.security:spring-security-config): 6.0.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.1.2

Step up your Open Source Security Game with Mend here

localize-16.1.4.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - localize-16.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (localize version) Remediation Possible**
CVE-2024-4068 High 7.5 braces-3.0.2.tgz Transitive N/A*
CVE-2024-4067 Medium 5.3 micromatch-4.0.5.tgz Transitive 16.1.5

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

  • localize-16.1.4.tgz (Root Library)
    • fast-glob-3.2.12.tgz
      • micromatch-4.0.5.tgz
        • braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: braces - 3.0.3

Step up your Open Source Security Game with Mend here

CVE-2024-4067

Vulnerable Library - micromatch-4.0.5.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

  • localize-16.1.4.tgz (Root Library)
    • fast-glob-3.2.12.tgz
      • micromatch-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution (micromatch): 4.0.6

Direct dependency fix Resolution (@angular/localize): 16.1.5

Step up your Open Source Security Game with Mend here

spring-boot-starter-thymeleaf-3.1.1.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-thymeleaf-3.1.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.1.1.RELEASE/thymeleaf-3.1.1.RELEASE.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-thymeleaf version) Remediation Possible**
CVE-2023-38286 High 7.5 thymeleaf-3.1.1.RELEASE.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-38286

Vulnerable Library - thymeleaf-3.1.1.RELEASE.jar

Library home page: http://www.thymeleaf.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.1.1.RELEASE/thymeleaf-3.1.1.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-thymeleaf-3.1.1.jar (Root Library)
    • thymeleaf-spring6-3.1.1.RELEASE.jar
      • thymeleaf-3.1.1.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Publish Date: 2023-07-14

URL: CVE-2023-38286

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7gj7-224w-vpr3

Release Date: 2023-07-14

Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE

Step up your Open Source Security Game with Mend here

h2-2.1.214.jar: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - h2-2.1.214.jar

H2 Database Engine

Library home page: https://h2database.com

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (h2 version) Remediation Possible**
CVE-2022-45868 High 7.8 h2-2.1.214.jar Direct 2.2.220

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-45868

Vulnerable Library - h2-2.1.214.jar

H2 Database Engine

Library home page: https://h2database.com

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar

Dependency Hierarchy:

  • h2-2.1.214.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

Publish Date: 2022-11-23

URL: CVE-2022-45868

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-22wj-vf5f-wrvj

Release Date: 2022-11-23

Fix Resolution: 2.2.220

Step up your Open Source Security Game with Mend here

spring-cloud-starter-openfeign-4.0.3.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-openfeign-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter-openfeign version) Remediation Possible**
CVE-2023-24998 High 7.5 commons-fileupload-1.4.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-24998

Vulnerable Library - commons-fileupload-1.4.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: http://commons.apache.org/proper/commons-fileupload/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-openfeign-4.0.3.jar (Root Library)
    • spring-cloud-openfeign-core-4.0.3.jar
      • feign-form-spring-3.8.0.jar
        • commons-fileupload-1.4.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Publish Date: 2023-02-20

URL: CVE-2023-24998

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-10.html

Release Date: 2023-02-20

Fix Resolution: commons-fileupload:commons-fileupload:1.5;org.apache.tomcat:tomcat-coyote:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat.embed:tomcat-embed-core:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat:tomcat-util:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat:tomcat-catalina:8.5.85,9.0.71,10.1.5,11.0.0-M3

Step up your Open Source Security Game with Mend here

spring-boot-starter-data-elasticsearch-3.1.1.jar: 5 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - spring-boot-starter-data-elasticsearch-3.1.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-data-elasticsearch version) Remediation Possible**
CVE-2024-22262 High 8.1 spring-web-6.0.7.jar Transitive 3.1.11
CVE-2024-22259 High 8.1 spring-web-6.0.7.jar Transitive 3.1.10
CVE-2024-22243 High 8.1 spring-web-6.0.7.jar Transitive 3.1.9
CVE-2023-4043 High 7.5 parsson-1.0.0.jar Transitive 3.3.0
CVE-2023-34053 High 7.5 spring-web-6.0.7.jar Transitive 3.1.6

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-22262

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.1.1.jar (Root Library)
    • spring-boot-starter-json-3.1.1.jar
      • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Publish Date: 2024-04-16

URL: CVE-2024-22262

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22262

Release Date: 2024-04-16

Fix Resolution (org.springframework:spring-web): 6.0.19

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-elasticsearch): 3.1.11

Step up your Open Source Security Game with Mend here

CVE-2024-22259

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.1.1.jar (Root Library)
    • spring-boot-starter-json-3.1.1.jar
      • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Publish Date: 2024-03-16

URL: CVE-2024-22259

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22259

Release Date: 2024-03-16

Fix Resolution (org.springframework:spring-web): 6.0.18

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-elasticsearch): 3.1.10

Step up your Open Source Security Game with Mend here

CVE-2024-22243

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.1.1.jar (Root Library)
    • spring-boot-starter-json-3.1.1.jar
      • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

Publish Date: 2024-02-23

URL: CVE-2024-22243

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22243

Release Date: 2024-02-23

Fix Resolution (org.springframework:spring-web): 6.0.17

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-elasticsearch): 3.1.9

Step up your Open Source Security Game with Mend here

CVE-2023-4043

Vulnerable Library - parsson-1.0.0.jar

Jakarta JSON Processing provider

Library home page: https://github.com/eclipse-ee4j/parsson

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/parsson/parsson/1.0.0/parsson-1.0.0.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.1.1.jar (Root Library)
    • spring-data-elasticsearch-5.0.4.jar
      • elasticsearch-java-8.7.1.jar
        • parsson-1.0.0.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Publish Date: 2023-11-03

URL: CVE-2023-4043

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13

Release Date: 2023-11-03

Fix Resolution (org.eclipse.parsson:parsson): 1.0.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-elasticsearch): 3.3.0

Step up your Open Source Security Game with Mend here

CVE-2023-34053

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.1.1.jar (Root Library)
    • spring-boot-starter-json-3.1.1.jar
      • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  • the application uses Spring MVC or Spring WebFlux
  • io.micrometer:micrometer-core is on the classpath
  • an ObservationRegistry is configured in the application to record observations

Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.

Publish Date: 2023-11-28

URL: CVE-2023-34053

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34053

Release Date: 2023-11-28

Fix Resolution (org.springframework:spring-web): 6.0.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-elasticsearch): 3.1.6

Step up your Open Source Security Game with Mend here

spring-boot-starter-undertow-3.1.1.jar: 5 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-undertow-3.1.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jboss/xnio/xnio-api/3.8.8.Final/xnio-api-3.8.8.Final.jar

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-undertow version) Remediation Possible**
CVE-2024-6162 High 7.5 undertow-core-2.3.7.Final.jar Transitive N/A*
CVE-2024-1635 High 7.5 undertow-core-2.3.7.Final.jar Transitive 3.1.9
CVE-2023-5685 High 7.5 xnio-api-3.8.8.Final.jar Transitive N/A*
CVE-2023-4639 High 7.4 undertow-core-2.3.7.Final.jar Transitive 3.1.9
CVE-2024-1459 Medium 5.3 undertow-core-2.3.7.Final.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-6162

Vulnerable Library - undertow-core-2.3.7.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.7.Final/undertow-core-2.3.7.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.1.1.jar (Root Library)
    • undertow-core-2.3.7.Final.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A vulnerability was found in Undertow. URL-encoded request path information can be broken for concurrent requests on ajp-listener, causing the wrong path to be processed and resulting in a possible denial of service.

Publish Date: 2024-06-20

URL: CVE-2024-6162

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=2293069

Release Date: 2024-06-20

Fix Resolution: io.undertow:undertow-core:2.3.14.Final

Step up your Open Source Security Game with Mend here

CVE-2024-1635

Vulnerable Library - undertow-core-2.3.7.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.7.Final/undertow-core-2.3.7.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.1.1.jar (Root Library)
    • undertow-core-2.3.7.Final.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.

At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Publish Date: 2024-02-19

URL: CVE-2024-1635

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=2264928

Release Date: 2024-02-19

Fix Resolution (io.undertow:undertow-core): 2.3.11.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-undertow): 3.1.9

Step up your Open Source Security Game with Mend here

CVE-2023-5685

Vulnerable Library - xnio-api-3.8.8.Final.jar

The API JAR of the XNIO project

Library home page: http://www.jboss.org/xnio

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jboss/xnio/xnio-api/3.8.8.Final/xnio-api-3.8.8.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.1.1.jar (Root Library)
    • undertow-core-2.3.7.Final.jar
      • xnio-api-3.8.8.Final.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

Publish Date: 2024-03-22

URL: CVE-2023-5685

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-4639

Vulnerable Library - undertow-core-2.3.7.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.7.Final/undertow-core-2.3.7.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.1.1.jar (Root Library)
    • undertow-core-2.3.7.Final.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Publish Date: 2023-08-30

URL: CVE-2023-4639

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-4639

Release Date: 2023-08-30

Fix Resolution (io.undertow:undertow-core): 2.3.11.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-undertow): 3.1.9

Step up your Open Source Security Game with Mend here

CVE-2024-1459

Vulnerable Library - undertow-core-2.3.7.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.7.Final/undertow-core-2.3.7.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.1.1.jar (Root Library)
    • undertow-core-2.3.7.Final.jar (Vulnerable Library)

Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d

Found in base branch: main

Vulnerability Details

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

Publish Date: 2024-02-12

URL: CVE-2024-1459

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v76w-3ph8-vm66

Release Date: 2024-02-12

Fix Resolution: io.undertow:undertow-core:2.2.31.Final,2.3.12.Final

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.