stefanfreitag / sht21 Goto Github PK

Vulnerable Library - commons-compress-1.9.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: http://commons.apache.org/proper/commons-compress/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.9/cc18955ff1e36d5abd39a14bfe82b19154330a34/commons-compress-1.9.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.9/cc18955ff1e36d5abd39a14bfe82b19154330a34/commons-compress-1.9.jar

Dependency Hierarchy:

• springdoc-openapi-ui-1.1.44.jar (Root Library)
  • webjars-locator-0.37.jar
    • webjars-locator-core-0.35.jar
      • ❌ commons-compress-1.9.jar (Vulnerable Library)

Found in HEAD commit: 8a1175bbc30d0a92780b8ddfe47276a3507e90af

Vulnerability Details

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

Publish Date: 2018-08-16

URL: CVE-2018-11771

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11771

Release Date: 2018-08-16

Fix Resolution: 1.18

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942

Release Date: 2019-10-01

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0.pr1

Vulnerable Library - spring-data-commons-1.13.9.RELEASE.jar

Global parent pom.xml to be used by Spring Data modules

Library home page: http://www.spring.io/spring-data/spring-data-commons

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • spring-data-jpa-1.11.9.RELEASE.jar
    • ❌ spring-data-commons-1.13.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

Publish Date: 2018-05-11

URL: CVE-2018-1259

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1259

Release Date: 2018-05-11

Fix Resolution: 1.13.12,2.0.7

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/sht21/sht21-restclient/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.2/1d8d8cb7cf26920ba57fb61fa56da88cc123b21f/jackson-databind-2.9.2.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Publish Date: 2018-02-06

URL: CVE-2017-15095

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15095

Release Date: 2018-02-06

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.10,com.fasterxml.jackson.core:jackson-databind:2.9.1

Vulnerable Library - spring-webmvc-4.3.13.RELEASE.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/4.3.13.RELEASE/87a095c7a1d13fe433ae6712787238c1dbaa6919/spring-webmvc-4.3.13.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/4.3.13.RELEASE/87a095c7a1d13fe433ae6712787238c1dbaa6919/spring-webmvc-4.3.13.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • ❌ spring-webmvc-4.3.13.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Publish Date: 2018-04-06

URL: CVE-2018-1271

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271

Release Date: 2018-04-06

Fix Resolution: org.springframework:spring-webmvc:5.0.5.RELEASE

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-07

URL: CVE-2019-17267

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17267

Release Date: 2019-10-07

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10

Vulnerable Library - tomcat-embed-core-8.5.23.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-boot-starter-tomcat-1.5.9.RELEASE.jar
      • tomcat-embed-websocket-8.5.23.jar
        • ❌ tomcat-embed-core-8.5.23.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

Publish Date: 2018-08-02

URL: CVE-2018-8037

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: http://www.securitytracker.com/id/1041376

Release Date: 2018-02-07

Fix Resolution: 8.5.32, 9.0.10

Vulnerable Library - spring-data-commons-1.13.9.RELEASE.jar

Global parent pom.xml to be used by Spring Data modules

Library home page: http://www.spring.io/spring-data/spring-data-commons

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • spring-data-jpa-1.11.9.RELEASE.jar
    • ❌ spring-data-commons-1.13.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Publish Date: 2018-04-11

URL: CVE-2018-1273

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273

Release Date: 2018-04-11

Fix Resolution: 1.13.11.RELEASE,2.0.6.RELEASE

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Publish Date: 2018-01-10

URL: CVE-2017-17485

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-databind@bb45fb1#diff-727a6e8db3603b95f185697108af6c48

Release Date: 2017-12-19

Fix Resolution: Replace or update the following files: AbstractApplicationContext.java, AbstractPointcutAdvisor.java, BogusApplicationContext.java, SubTypeValidator.java, BogusPointcutAdvisor.java, IllegalTypesCheckTest.java

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-03-21

URL: CVE-2018-12022

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12022

Release Date: 2019-03-21

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.4,com.fasterxml.jackson.core:jackson-databind: 2.8.11.2,com.fasterxml.jackson.core:jackson-databind: 2.9.6

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14720

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14720

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19362

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19362

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.8

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

Publish Date: 2019-09-15

URL: CVE-2019-16335

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x

Release Date: 2019-09-15

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Publish Date: 2018-02-26

URL: CVE-2018-7489

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-7489

Release Date: 2018-02-26

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.1,com.fasterxml.jackson.core:jackson-databind:2.9.5

Vulnerable Library - spring-web-4.3.13.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/4.3.13.RELEASE/7cd084992d546165ede3e99bc31ee49c937f0ce7/spring-web-4.3.13.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/4.3.13.RELEASE/7cd084992d546165ede3e99bc31ee49c937f0ce7/spring-web-4.3.13.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-webmvc-4.3.13.RELEASE.jar
      • ❌ spring-web-4.3.13.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Publish Date: 2018-10-18

URL: CVE-2018-15756

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2018-15756

Release Date: 2018-10-18

Fix Resolution: org.springframework:spring-web:4.3.20,org.springframework:spring-web:5.0.10,org.springframework:spring-web:5.1.1

Vulnerable Library - spring-data-jpa-1.11.9.RELEASE.jar

Spring Data module for JPA repositories.

Library home page: http://projects.spring.io/spring-data-jpa

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-jpa/1.11.9.RELEASE/64c80f12361d5b74cf98a3433b59a5c961d78d38/spring-data-jpa-1.11.9.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • ❌ spring-data-jpa-1.11.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

Publish Date: 2019-05-06

URL: CVE-2019-3797

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2019-3797

Release Date: 2019-04-15

Fix Resolution: org.springframework.data:spring-data-jpa:1.11.20,org.springframework.data:spring-data-jpa: 2.0.14,org.springframework.data:spring-data-jpa: 2.1.6

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19361

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19361

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.8

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Publish Date: 2019-07-30

URL: CVE-2019-14439

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14439

Release Date: 2019-07-30

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.9.2

Vulnerable Library - dom4j-1.6.1.jar

dom4j: the flexible XML framework for Java

Library home page: http://dom4j.org

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/dom4j/dom4j/1.6.1/5d3ccc056b6f056dbf0dddfdf43894b9065a8f94/dom4j-1.6.1.jar,/root/.gradle/caches/modules-2/files-2.1/dom4j/dom4j/1.6.1/5d3ccc056b6f056dbf0dddfdf43894b9065a8f94/dom4j-1.6.1.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • hibernate-core-5.0.12.Final.jar
    • ❌ dom4j-1.6.1.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Publish Date: 2018-08-20

URL: CVE-2018-1000632

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000632

Release Date: 2018-08-20

Fix Resolution: dom4j:dom4j:2.1.1

Vulnerable Library - tomcat-embed-core-8.5.23.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-boot-starter-tomcat-1.5.9.RELEASE.jar
      • tomcat-embed-websocket-8.5.23.jar
        • ❌ tomcat-embed-core-8.5.23.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Publish Date: 2018-05-16

URL: CVE-2018-8014

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Change files

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-8014

Release Date: 2019-04-08

Fix Resolution: Replace or update the following files: 7.0.89, 8.0.53, 8.5.32, 9.0.9

Vulnerable Library - hibernate-validator-6.0.17.Final.jar

Hibernate's Bean Validation (JSR-380) reference implementation.

Library home page: http://hibernate.org/validator/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.hibernate.validator/hibernate-validator/6.0.17.Final/af73055fc4a103ab347c56e7da5a143d68a0170/hibernate-validator-6.0.17.Final.jar,/root/.gradle/caches/modules-2/files-2.1/org.hibernate.validator/hibernate-validator/6.0.17.Final/af73055fc4a103ab347c56e7da5a143d68a0170/hibernate-validator-6.0.17.Final.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-2.1.6.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.1.6.RELEASE.jar
    • ❌ hibernate-validator-6.0.17.Final.jar (Vulnerable Library)

Found in HEAD commit: 8a1175bbc30d0a92780b8ddfe47276a3507e90af

Vulnerability Details

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Publish Date: 2019-11-08

URL: CVE-2019-10219

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10219

Release Date: 2019-11-08

Fix Resolution: 6.1.0.Final

Vulnerable Library - tomcat-embed-core-8.5.23.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-boot-starter-tomcat-1.5.9.RELEASE.jar
      • tomcat-embed-websocket-8.5.23.jar
        • ❌ tomcat-embed-core-8.5.23.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Publish Date: 2019-06-21

URL: CVE-2019-10072

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41

Release Date: 2019-06-21

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:8.5.41,org.apache.tomcat.embed:tomcat-embed-core:9.0.20

Vulnerable Library - h2-1.4.196.jar

H2 Database Engine

Library home page: http://www.h2database.com

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/com.h2database/h2/1.4.196/dd0034398d593aa3588c6773faac429bbd9aea0e/h2-1.4.196.jar

Dependency Hierarchy:

• ❌ h2-1.4.196.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.

Publish Date: 2018-04-11

URL: CVE-2018-10054

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10054

Release Date: 2018-04-11

Fix Resolution: com.h2database:h2:1.4.198

Vulnerable Library - httpclient-4.5.2.jar

Apache HttpComponents Client

Library home page: http://hc.apache.org/httpcomponents-client

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.2/733db77aa8d9b2d68015189df76ab06304406e50/httpclient-4.5.2.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.2/733db77aa8d9b2d68015189df76ab06304406e50/httpclient-4.5.2.jar,le/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.2/733db77aa8d9b2d68015189df76ab06304406e50/httpclient-4.5.2.jar

Dependency Hierarchy:

• ❌ httpclient-4.5.2.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2019-05-30

URL: WS-2017-3734

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2019-05-30

Fix Resolution: org.apache.httpcomponents.core5:httpcore5:4.5.3

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

Publish Date: 2019-06-19

URL: CVE-2019-12814

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2341

Release Date: 2019-06-19

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.6,com.fasterxml.jackson.core:jackson-databind: 2.8.11.4,com.fasterxml.jackson.core:jackson-databind: 2.9.9.1,com.fasterxml.jackson.core:jackson-databind: 2.10.0

Vulnerable Library - guava-20.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar

Dependency Hierarchy:

• springfox-swagger2-2.8.0.jar (Root Library)
  • ❌ guava-20.0.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: com.google.guava:guava:24.1.1

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Publish Date: 2018-01-22

URL: CVE-2018-5968

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5968

Release Date: 2018-01-22

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.1,com.fasterxml.jackson.core:jackson-databind: 2.9.4

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Publish Date: 2019-06-24

URL: CVE-2019-12384

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12384

Release Date: 2019-08-12

Fix Resolution: 2.9.9.1

Vulnerable Library - log4j-core-2.7.jar

The Apache Log4j Implementation

Library home page: http://logging.apache.org/log4j/2.x/log4j-core/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/org.apache.logging.log4j/log4j-core/2.7/a3f2b4e64c61a7fc1ed8f1e5ba371933404ed98a/log4j-core-2.7.jar

Dependency Hierarchy:

• ❌ log4j-core-2.7.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Publish Date: 2017-04-17

URL: CVE-2017-5645

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-5645

Release Date: 2017-04-17

Fix Resolution: 2.8.2

Vulnerable Library - tomcat-embed-websocket-8.5.23.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-websocket/8.5.23/52f07abcae10dc7e1764304b0877def175c2c833/tomcat-embed-websocket-8.5.23.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-boot-starter-tomcat-1.5.9.RELEASE.jar
      • ❌ tomcat-embed-websocket-8.5.23.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Publish Date: 2018-08-01

URL: CVE-2018-8034

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034

Release Date: 2018-08-01

Fix Resolution: org.apache.tomcat:tomcat-websocket:7.0.90,org.apache.tomcat:tomcat-websocket: 8.0.53,org.apache.tomcat:tomcat-websocket: 8.5.32,org.apache.tomcat:tomcat-websocket: 9.0.10

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19360

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19360

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.8

Vulnerable Libraries - spring-webmvc-4.3.13.RELEASE.jar, spring-web-4.3.13.RELEASE.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

Publish Date: 2018-06-25

URL: CVE-2018-11040

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-11040

Release Date: 2018-06-25

Fix Resolution: 5.0.7,4.3.18

Vulnerable Library - spring-web-4.3.13.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/4.3.13.RELEASE/7cd084992d546165ede3e99bc31ee49c937f0ce7/spring-web-4.3.13.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/4.3.13.RELEASE/7cd084992d546165ede3e99bc31ee49c937f0ce7/spring-web-4.3.13.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-webmvc-4.3.13.RELEASE.jar
      • ❌ spring-web-4.3.13.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Publish Date: 2018-06-25

URL: CVE-2018-11039

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-11039

Release Date: 2018-06-25

Fix Resolution: org.springframework:spring-web:5.0.7,org.springframework:spring-web:4.3.18

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14719

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14719

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7

Vulnerable Library - spring-data-jpa-1.11.9.RELEASE.jar

Spring Data module for JPA repositories.

Library home page: http://projects.spring.io/spring-data-jpa

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-jpa/1.11.9.RELEASE/64c80f12361d5b74cf98a3433b59a5c961d78d38/spring-data-jpa-1.11.9.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • ❌ spring-data-jpa-1.11.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Publish Date: 2019-06-03

URL: CVE-2019-3802

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3802

Release Date: 2019-06-03

Fix Resolution: org.springframework.data:spring-data-jpa:1.11.22.RELEASE,org.springframework.data:spring-data-jpa:2.1.8.RELEASE

Vulnerable Library - spring-data-commons-1.13.9.RELEASE.jar

Global parent pom.xml to be used by Spring Data modules

Library home page: http://www.spring.io/spring-data/spring-data-commons

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework.data/spring-data-commons/1.13.9.RELEASE/3910a598235d2e9c1ca56f34c5e62bb5ce23778/spring-data-commons-1.13.9.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • spring-data-jpa-1.11.9.RELEASE.jar
    • ❌ spring-data-commons-1.13.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

Publish Date: 2018-04-18

URL: CVE-2018-1274

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274

Release Date: 2018-04-18

Fix Resolution: 1.13.11.RELEASE,2.0.6.RELEASE

Vulnerable Libraries - jackson-datatype-jsr310-2.8.10.jar, jackson-datatype-jsr310-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

Publish Date: 2018-12-20

URL: CVE-2018-1000873

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000873

Release Date: 2018-12-20

Fix Resolution: 2.9.8

Vulnerable Library - tomcat-embed-core-8.5.23.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.5.23/79261793a47f507890ee08f749b9d81774e4f7f0/tomcat-embed-core-8.5.23.jar

Dependency Hierarchy:

• spring-boot-starter-data-rest-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-web-1.5.9.RELEASE.jar
    • spring-boot-starter-tomcat-1.5.9.RELEASE.jar
      • tomcat-embed-websocket-8.5.23.jar
        • ❌ tomcat-embed-core-8.5.23.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Publish Date: 2019-04-10

URL: CVE-2019-0199

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0199

Release Date: 2019-04-10

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:8.5.38,org.apache.tomcat.embed:tomcat-embed-core:9.0.14

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14721

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-databind@87d29af

Release Date: 2018-08-16

Fix Resolution: Replace or update the following files: VERSION, BeanDeserializerFactory.java

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14718

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14718

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7

Vulnerable Library - commons-codec-1.9.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Library home page: http://commons.apache.org/proper/commons-codec/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar,/root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar,le/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar

Dependency Hierarchy:

• httpclient-4.5.2.jar (Root Library)
  • ❌ commons-codec-1.9.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Not all "business" method implementations of public API in Apache Commons Codec 1.x are thread safe, which might disclose the wrong data or allow an attacker to change non-private fields.Updated 2018-10-07 - an additional review by WhiteSource research team could not indicate on a clear security vulnerability.

Publish Date: 2007-10-07

URL: WS-2009-0001

CVSS 2 Score Details (0.0)

Base Score Metrics not available

Vulnerable Library - commons-compress-1.9.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: http://commons.apache.org/proper/commons-compress/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.9/cc18955ff1e36d5abd39a14bfe82b19154330a34/commons-compress-1.9.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.9/cc18955ff1e36d5abd39a14bfe82b19154330a34/commons-compress-1.9.jar

Dependency Hierarchy:

• springdoc-openapi-ui-1.1.44.jar (Root Library)
  • webjars-locator-0.37.jar
    • webjars-locator-core-0.35.jar
      • ❌ commons-compress-1.9.jar (Vulnerable Library)

Found in HEAD commit: 8a1175bbc30d0a92780b8ddfe47276a3507e90af

Vulnerability Details

The example Expander class in Apache Commons Compress before 1.18 has been vulnerable to a path traversal in the edge case that happens when the target directory has a sibling directory and the name of the target directory is a prefix of the sibling directory's name.

Publish Date: 2019-09-26

URL: WS-2018-0601

CVSS 2 Score Details (6.0)

Base Score Metrics not available

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.10

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Publish Date: 2019-07-09

URL: CVE-2018-11307

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2032

Release Date: 2019-03-17

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:jackson-databind-2.9.6

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x

Release Date: 2019-09-15

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Publish Date: 2019-05-17

URL: CVE-2019-12086

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086

Release Date: 2019-05-17

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.9

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Publish Date: 2019-07-29

URL: CVE-2019-14379

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14379

Release Date: 2019-07-29

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.9.2

Vulnerable Libraries - jackson-databind-2.8.10.jar, jackson-databind-2.9.2.jar

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-03-21

URL: CVE-2018-12023

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-databind@7487cf7

Release Date: 2018-06-01

Fix Resolution: Replace or update the following file: SubTypeValidator.java

Vulnerable Library - spring-core-4.3.13.RELEASE.jar

Spring Core

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/4.3.13.RELEASE/eea18d7f4d01f1baa1b6728b678b5a6fe23c61f6/spring-core-4.3.13.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/4.3.13.RELEASE/eea18d7f4d01f1baa1b6728b678b5a6fe23c61f6/spring-core-4.3.13.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-data-jpa-1.5.9.RELEASE.jar (Root Library)
  • spring-boot-starter-jdbc-1.5.9.RELEASE.jar
    • spring-jdbc-4.3.13.RELEASE.jar
      • spring-tx-4.3.13.RELEASE.jar
        • ❌ spring-core-4.3.13.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 4057e364d8f0e9a2d440890a01e74a338ec8ffbd

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Publish Date: 2018-04-06

URL: CVE-2018-1272

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2018-1272

Fix Resolution: Users of affected versions should apply the following mitigation: 5.0.x users should upgrade to 5.0.5 4.3.x users should upgrade to 4.3.15 There are no other mitigation steps necessary.