Vulnerable Library - tomcat-embed-core-9.0.60.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.60/tomcat-embed-core-9.0.60.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-tomcat-2.6.6.jar
    • ❌ tomcat-embed-core-9.0.60.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Publish Date: 2022-11-01

URL: CVE-2022-42252

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-p22x-g9px-3945

Release Date: 2022-11-01

Fix Resolution: org.apache.tomcat:tomcat:8.5.83,9.0.68,10.0.27,10.1.1

Vulnerable Library - jackson-databind-2.13.2.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.2.2/jackson-databind-2.13.2.2.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-json-2.6.6.jar
    • ❌ jackson-databind-2.13.2.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: 2022-10-02

URL: CVE-2022-42004

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-02

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.13.4

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.7

Vulnerable Library - spring-expression-5.3.18.jar

Spring Expression Language (SpEL)

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.3.18/spring-expression-5.3.18.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-webmvc-5.3.18.jar
    • ❌ spring-expression-5.3.18.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-03-23

URL: CVE-2023-20861

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://securityonline.info/cve-2023-20860-high-severity-vulnerability-in-spring-framework/

Release Date: 2023-03-23

Fix Resolution (org.springframework:spring-expression): 5.3.25

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.7.8

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38750

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - spring-web-5.3.18.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.3.18/spring-web-5.3.18.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • ❌ spring-web-5.3.18.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Mend Note: After conducting further research, Mend has determined that all versions of spring-web up to version 6.0.0 are vulnerable to CVE-2016-1000027.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-4wrc-f8pq-fpqp

Release Date: 2020-01-02

Fix Resolution (org.springframework:spring-web): 6.0.0

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - spring-context-5.3.18.jar

Spring Context

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/5.3.18/spring-context-5.3.18.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-webmvc-5.3.18.jar
    • ❌ spring-context-5.3.18.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Publish Date: 2022-04-14

URL: CVE-2022-22968

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22968

Release Date: 2022-04-14

Fix Resolution (org.springframework:spring-context): 5.3.19

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.7

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38751

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Publish Date: 2022-12-01

URL: CVE-2022-1471

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374

Release Date: 2022-12-01

Fix Resolution: org.yaml:snakeyaml:2.0

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Publish Date: 2022-08-30

URL: CVE-2022-25857

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857

Release Date: 2022-08-30

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - tomcat-embed-core-9.0.60.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.60/tomcat-embed-core-9.0.60.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-tomcat-2.6.6.jar
    • ❌ tomcat-embed-core-9.0.60.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Publish Date: 2022-09-28

URL: CVE-2021-43980

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3

Release Date: 2022-09-28

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.62

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.7

Vulnerable Library - spring-expression-5.3.18.jar

Spring Expression Language (SpEL)

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.3.18/spring-expression-5.3.18.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-webmvc-5.3.18.jar
    • ❌ spring-expression-5.3.18.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-04-13

URL: CVE-2023-20863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-20863

Release Date: 2023-04-13

Fix Resolution (org.springframework:spring-expression): 5.3.27

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - tomcat-embed-core-9.0.60.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.60/tomcat-embed-core-9.0.60.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-tomcat-2.6.6.jar
    • ❌ tomcat-embed-core-9.0.60.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Mend Note: After conducting further research, Mend has determined that versions 10.0.x of org.apache.tomcat:tomcat-catalina are vulnerable to CVE-2022-45143.

Publish Date: 2023-01-03

URL: CVE-2022-45143

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-rq2w-37h9-vg94

Release Date: 2023-01-03

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.69

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.14

Vulnerable Library - spring-security-crypto-5.6.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-crypto/5.6.2/spring-security-crypto-5.6.2.jar

Dependency Hierarchy:

• spring-cloud-starter-alibaba-nacos-discovery-2021.0.1.0.jar (Root Library)
  • spring-cloud-commons-3.1.1.jar
    • ❌ spring-security-crypto-5.6.2.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

Publish Date: 2022-05-19

URL: CVE-2022-22976

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22976

Release Date: 2022-05-19

Fix Resolution (org.springframework.security:spring-security-crypto): 5.6.4

Direct dependency fix Resolution (com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-discovery): 2021.0.4.0

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

Publish Date: 2022-11-11

URL: CVE-2022-41854

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/531/

Release Date: 2022-11-11

Fix Resolution (org.yaml:snakeyaml): 1.32

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Publish Date: 2022-09-05

URL: CVE-2022-38752

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-9w3m-gqgf-c4p9

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.32

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Library - snakeyaml-1.29.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.29/snakeyaml-1.29.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-2.6.6.jar
    • ❌ snakeyaml-1.29.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38749

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027

Release Date: 2022-09-05

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

Vulnerable Libraries - spring-beans-5.3.18.jar, spring-core-5.3.18.jar

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Publish Date: 2022-05-12

URL: CVE-2022-22970

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22970

Release Date: 2022-05-12

Fix Resolution (org.springframework:spring-beans): 5.3.20

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.8

Fix Resolution (org.springframework:spring-core): 5.3.20

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.8

Vulnerable Library - jackson-databind-2.13.2.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /cloudsnows-gateway/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.2.2/jackson-databind-2.13.2.2.jar

Dependency Hierarchy:

• spring-boot-starter-web-2.6.6.jar (Root Library)
  • spring-boot-starter-json-2.6.6.jar
    • ❌ jackson-databind-2.13.2.2.jar (Vulnerable Library)

Found in HEAD commit: 8df09d69d932d42fad46e1b5fc2233f332f01ec2

Found in base branch: master

Vulnerability Details

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1

Publish Date: 2022-10-02

URL: CVE-2022-42003

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-02

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.13.4.1

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.7