Code Monkey home page Code Monkey logo

intellimerge's Introduction

IntelliMerge

Notice: This repo is now maintained independently and privately as an industrial project since 2020, which means no updates for the open source version.

IntelliMerge is a graph-based refactoring-aware three-way merging tool for Java programs and repositories.

Introduction

Refactoring is a popular practice in object-oriented programming, especially with the support of automatic refactoring tools. However, it brings trouble to existing merging tools, both text-based ones (like git-merge) or tree-based ones (like jFSTMerge). On one hand, it tends to cause more merge conflicts that are hard to understand and resolve. On the other hand, merging tools are likely to generate incorrectly auto-merged results and thus introduce potential bugs.

Therefore, we implement IntelliMerge, a a graph-based refactoring-aware three-way merging tool for Java programs and repositories. It can reduce the number of false positive conflicts comparing with git-merge and jFSTMerge without sacrificing the precision of auto-merging parts. Besides, by representing programs as a graph, it allows for building interesting applications that consume the intermediate data, for example, a GUI client to assist developers in manually resolving conflicts, which can visualize refactoring changes and connections between conflict blocks.

  • Three-way merging

When merging two branches, they are compared with their nearest common ancestor (NCA) in the commit history to determine what changes and what stays untouched. This scenario is called "three-way merging", which involves the two versions to be merged and the base version at their NCA.

  • Graph-based

Instead of merging files one by one like most merging tools, IntelliMerge represents each version as graphs (named Program Element Graphs (PEG)) and performs merging by aligning the program elements correctly according to their semantics. The vertex set of the PEG consists of program elements of object-oriented programs (e.g. classes, methods, fields), while the edge set consists of the relations between program elements (e.g. method invocation, field access). ​

  • Refactoring-aware

With the 3 program element graphs, IntelliMerge tries to align program elements involved in refactorings across them. Instead of detecting every refactoring types, IntelliMerge categories refactorings into 1-to-1 and m-to-n according to their effects, and employs a list of heuristic rules to align program elements before and after refactorings. ​
We choose this approach for the following reasons: (1) one program element might be involved in multiple refactorings and edits between the base version and the merging version, therefore the target of our work is not refactoring detection but program merging with enhanced ability in handling refactoring changes, (2) refactoring is a general summary of best practices that constantly changes over time, there are multiple versions of refactoring types (we follow the one proposed by Martin Fowler), our formulation supports refactorings in a broader sense.


As a User

Requirements

  • Windows (Recommended) /Linux
  • Java 8
  • Git 2.18.0

Usage

JAR Usage

Download the latest jar from: https://github.com/Symbolk/IntelliMerge/releases, and run the following command to use it:

java -jar IntelliMerge-VERSION.jar [OPTIONS]

Available options will be printed if no options are given:

Please specify ONE of the following options: -r, -d.
Usage: IntelliMerge [options]
  Options:
    -b, --branches
      Names of branches to be merged. The order should be <left> <right> to
      merge <right> branch to <left>.
      Default: []
    -d, --directories
      Absolute path of three directories with Java files inside to be merged.
      The order should be <left> <base> <right>.
      Default: []
    -s, --hasSubModule
      Whether the repository has sub module.
      Default: true
    -o, --output
      Absolute path of an empty directory to save the merging results.
      Default: <empty string>
    -r, --repo
      Absolute path of the target Git repository.
      Default: <empty string>
    -t, --threshold
      [Optional] The threshold value for heuristic rules, default: 0.618.
      Default: 0.618

Input

  • Merging branches:
  1. The absolute path of a cloned repository.

  2. Names of the two local branches to be merged, make sure they are local branches with the following command:

    D:\github\repos\fastjson (android -> origin)
    $ git branch
    * android
      master
  • Merging directories:
  1. The absolute paths of 3 directories that contains Java files to be merged, in the order ours base theirs.

  2. The absolute path of the output directory.

Output

  1. Merged Java files.

  2. A csv file with the alignment information of program elements affected by refactorings, which can be consumed by the IntelliMerge-UI (under development) for developers to verify resolved conflicts and manually resolve remained conflicts.

    Example:

refactoring_type;node_type;confidence;before_location;before_node;after_location;after_node
Change Method Signature;method;0.8035;9-11;String getDirector();23-25;String getDirector()
Change Method Signature;method;0.9747;13-15;void setDirector(String director);27-29;void setDirector(String director)
Change Method Signature;method;0.8065;15-20;int getFrequentRenterPoints(int daysRented);15-20;int getPointsOfFrequentRenters(int daysRented)
Change Method Signature;method;0.8027;8-10;int getFrequentRenterPoints(int daysRented);8-10;int getPointsOfFrequentRenters(int daysRented)
Change Field Signature;field;1.0;4-4;private String director;10-10;public String director

Example

We provide a sample repository as the example input data, so you can have a quick try.

  1. Clone the sample repository from: https://github.com/Symbolk/intellimerge-sample-input, suppose that it is cloned into: D:\github\intellimerge-sample-input\

  2. Checkout local branches from remote ones with the following command under the cloned repository:

git checkout ours
git checkout theirs
  1. Merge branches with the following command:

    java -jar IntelliMerge-VERSION.jar -r D:\github\intellimerge-sample-input -s true -b ours theirs -o D:\github\intellimerge-sample-input\result1

    Remember to replace the arguments with the path where you clone the sample repository into.

  2. Merge directories with the following command:

    git checkout master
    java -jar IntelliMerge-VERSION.jar -d D:\github\intellimerge-sample-input\src\main\java\bad\robot\refactoring\left D:\github\intellimerge-sample-input\src\main\java\bad\robot\refactoring\base D:\github\intellimerge-sample-input\src\main\java\bad\robot\refactoring\right -o D:\github\intellimerge-sample-input\result2

API Usage

IntelliMerge provides the following APIs to use programmatically:

List<String> mergeBranches(
      String repoPath, List<String> branchNames, String outputPath, boolean hasSubModule)

Merge two local branches of a Git repository.

Parameters

  1. repoPath: Absolute path of the target Git repository.
  2. branchNames: Names of two local branches to be merged. The order should be <left> <right> to merge <right> branch to <left>.
  3. outputPath: Absolute path of an empty directory to save the merging results.
  4. hasSubModule: Whether the Git repository has submodules.

Return Value

File paths of the merging results.

List<String> mergeDirectories(List<String> directoryPaths, String outputPath)

Merge three directories that contains Java files.

Parameters

  1. directoryPaths: Absolute paths of three directories with Java files inside to be merged. The order should be <left> <base> <right>.
  2. outputPath: Absolute path of an empty directory to save the merging results.

Return Value

File paths of the merging results.

Example

We provide two sample projects to demonstrate the API usage, which can serve as the scaffold to build applications upon:

Sample code snippets about API usage:

// 1. merging branches
IntelliMerge merger = new IntelliMerge();
String outputPath = repoPath + "/results1";
boolean hasSubModule = false;
List<String> branchNames = new ArrayList<>();
branchNames.add("ours");
branchNames.add("theirs");

try {
    List<String> resultFilePaths = merger.mergeBranches(repoPath, branchNames, outputPath, hasSubModule);
    System.out.println("Merging results:");
    for (String path : resultFilePaths) {
        System.out.println(path);
    }
} catch (Exception e) {
    e.printStackTrace();
}
// 2. merging directories
IntelliMerge merger = new IntelliMerge();
List<String> directoryPaths = new ArrayList<>();
String outputPath = repoPath + "/results2";

directoryPaths.add(repoPath + "/src/main/java/bad/robot/refactoring/left");
directoryPaths.add(repoPath + "/src/main/java/bad/robot/refactoring/base");
directoryPaths.add(repoPath + "/src/main/java/bad/robot/refactoring/right");
try {
    List<String> resultFilePaths = merger.mergeDirectories(directoryPaths, outputPath);
    System.out.println("Merging results:");
    for (String path : resultFilePaths) {
        System.out.println(path);
    }
} catch (Exception e) {
    e.printStackTrace();
}

As a Developer

Requirements

  • Windows (Recommended) /Linux
  • JDK 8
  • Git 2.18.0
  • Gradle 4.10.1
  • IntelliJ IDEA (with Gradle integration)
  • MongoDB (only when performing evaluation)

Environment Setup

  1. Open the cloned repository as a project with IntelliJ IDEA;

  2. Download dependencies by clicking the refresh button in the Gradle tab of IDEA;

    gradle

  3. Run IntelliMerge.main() to see options available.

    Usage: IntelliMerge [options]
      Options:
        -b, --branches
          Names of branches to be merged. The order should be <left> <right> to
          merge <right> branch to <left>.
          Default: []
        -d, --directories
          Absolute path of three directories with Java files inside to be merged.
          The order should be <left> <base> <right>.
          Default: []
        -o, --output
          Absolute path of an empty directory to save the merging results.
          Default: <empty string>
        -r, --repo
          Absolute path of the target Git repository.
          Default: <empty string>
        -t, --threshold
          [Optional] The threshold value for heuristic rules, default: 0.618.
          Default: 0.618

Build the JAR from source

Run the following command under the root of the cloned repository to build an executable jar with all dependencies packaged:

gradle fatJar

Packaged jar file will be generated in build\libs, with the name IntelliMerge-VERSION-all.jar.

Project Structure

IntelliMerge   
   ├─client     
   ├─core
   │  ├─GraphBuilder
   │  ├─GraphMatcher
   │  └─GraphMerger
   ├─evaluation 
   ├─exception  
   ├─io
   │  └─GraphExporter         
   ├─model      
   │  ├─constant
   │     ├─EdgeType
   │     └─NodeType
   │  ├─mapping 
   │  └─node
   │     ├─SemanticNode
   │     └─SemanticEdge      
   └─util
       ├─GitService
       └─SimilarityAlg
          

P.S. Major components are listed.

intellimerge's People

Contributors

mend-bolt-for-github[bot] avatar symbolk avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

intellimerge's Issues

CVE-2020-5421 (Medium) detected in spring-web-4.1.6.RELEASE.jar

CVE-2020-5421 - Medium Severity Vulnerability

Vulnerable Library - spring-web-4.1.6.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Publish Date: 2020-09-19

URL: CVE-2020-5421

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2020-5421

Release Date: 2020-07-21

Fix Resolution: org.springframework:spring-web:5.2.9,org.springframework:spring-web:5.1.18,org.springframework:spring-web:5.0.19,org.springframework:spring-web:4.3.29


Step up your Open Source Security Game with WhiteSource here

CVE-2017-9735 (High) detected in jetty-util-9.4.6.v20170531.jar

CVE-2017-9735 - High Severity Vulnerability

Vulnerable Library - jetty-util-9.4.6.v20170531.jar

Utility classes for Jetty

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-util-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Publish Date: 2017-06-16

URL: CVE-2017-9735

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784

Release Date: 2017-06-16

Fix Resolution: 9.4.7.RC0


Step up your Open Source Security Game with WhiteSource here

test cases failed

Hi, I am recently trying to know more about Intellimerge but as I set up the project I found that most test cases failed because the numbers don't add up. I was wondering if there was something wrong with my setup.
Sincerely hopo to get your response and help.

here are some screenshots.
image
image
image

CVE-2020-27218 (Medium) detected in jetty-server-9.4.6.v20170531.jar

CVE-2020-27218 - Medium Severity Vulnerability

Vulnerable Library - jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Publish Date: 2020-11-28

URL: CVE-2020-27218

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-86wm-rrjm-8wh8

Release Date: 2020-11-28

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.35.v20201120, 10.0.0.beta3, 11.0.0.beta3


Step up your Open Source Security Game with WhiteSource here

CVE-2016-1000027 (High) detected in spring-web-4.1.6.RELEASE.jar

CVE-2016-1000027 - High Severity Vulnerability

Vulnerable Library - spring-web-4.1.6.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: spring-projects/spring-framework@76964e1

Release Date: 2016-05-03

Fix Resolution: Replace or update the following files: HttpInvokerProxyFactoryBean.java, HttpInvokerServiceExporter.java


Step up your Open Source Security Game with WhiteSource here

CVE-2017-7658 (High) detected in jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

CVE-2017-7658 - High Severity Vulnerability

Vulnerable Libraries - jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

jetty-http-9.4.6.v20170531.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-http-9.4.6.v20170531.jar (Vulnerable Library)
jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Publish Date: 2018-06-26

URL: CVE-2017-7658

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658

Release Date: 2018-06-26

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty.aggregate:jetty-client:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty:jetty-http:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606


Step up your Open Source Security Game with WhiteSource here

WS-2019-0379 (Medium) detected in commons-codec-1.10.jar

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.10.jar

Library home page: http://archive.apache.org/dist/cxf/2.7.17/apache-cxf-2.7.17.zip

Path to vulnerable library: IntelliMerge/lib/commons-codec-1.10.jar

Dependency Hierarchy:

  • commons-codec-1.10.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13


Step up your Open Source Security Game with WhiteSource here

CVE-2017-7657 (High) detected in jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

CVE-2017-7657 - High Severity Vulnerability

Vulnerable Libraries - jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

jetty-http-9.4.6.v20170531.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-http-9.4.6.v20170531.jar (Vulnerable Library)
jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Publish Date: 2018-06-26

URL: CVE-2017-7657

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668

Release Date: 2018-06-26

Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605;org.eclipse.jetty:jetty-http:9.3.24.v20180605,9.4.11.v20180605


Step up your Open Source Security Game with WhiteSource here

CVE-2018-1199 (Medium) detected in spring-core-4.1.6.RELEASE.jar

CVE-2018-1199 - Medium Severity Vulnerability

Vulnerable Library - spring-core-4.1.6.RELEASE.jar

Spring Core

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-core-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-core-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Publish Date: 2018-03-16

URL: CVE-2018-1199

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1199

Release Date: 2018-03-16

Fix Resolution: org.springframework.security:spring-security-web:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework.security:spring-security-config:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework:spring-core:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,4.3.14.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2018-1272 (High) detected in spring-web-4.1.6.RELEASE.jar

CVE-2018-1272 - High Severity Vulnerability

Vulnerable Library - spring-web-4.1.6.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Publish Date: 2018-04-06

URL: CVE-2018-1272

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2018-1272

Release Date: 2018-04-06

Fix Resolution: org.springframework:spring-core:4.3.15.RELEASE,5.0.5.RELEASE;org.springframework:spring-web:4.3.15.RELEASE,5.0.5.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8908 (Low) detected in guava-27.0.1-jre.jar

CVE-2020-8908 - Low Severity Vulnerability

Vulnerable Library - guava-27.0.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: IntelliMerge/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/27.0.1-jre/bd41a290787b5301e63929676d792c507bbc00ae/guava-27.0.1-jre.jar

Dependency Hierarchy:

  • google-java-format-1.7.jar (Root Library)
    • guava-27.0.1-jre.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-12536 (Medium) detected in multiple libraries

CVE-2018-12536 - Medium Severity Vulnerability

Vulnerable Libraries - jetty-servlet-9.4.6.v20170531.jar, jetty-util-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

jetty-servlet-9.4.6.v20170531.jar

Jetty Servlet Container

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-servlet-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-servlet-9.4.6.v20170531.jar (Vulnerable Library)
jetty-util-9.4.6.v20170531.jar

Utility classes for Jetty

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-util-9.4.6.v20170531.jar (Vulnerable Library)
jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

Publish Date: 2018-06-27

URL: CVE-2018-12536

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jetty/jetty.project@ad4dceb

Release Date: 2018-06-27

Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-util:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-servlet:9.3.24.v20180605,9.4.11.v20180605


Step up your Open Source Security Game with WhiteSource here

CVE-2017-7656 (High) detected in jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

CVE-2017-7656 - High Severity Vulnerability

Vulnerable Libraries - jetty-http-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

jetty-http-9.4.6.v20170531.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-http-9.4.6.v20170531.jar (Vulnerable Library)
jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Publish Date: 2018-06-26

URL: CVE-2017-7656

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667

Release Date: 2018-06-26

Fix Resolution: org.eclipse.jetty:jetty-server:9.2.25.v20180606,9.3.24.v20180605,9.4.11.v20180605;org.eclipse.jetty:jetty-http:9.2.25.v20180606.,9.3.24.v20180605,9.4.11.v20180605


Step up your Open Source Security Game with WhiteSource here

CVE-2016-5007 (High) detected in spring-webmvc-4.1.6.RELEASE.jar

CVE-2016-5007 - High Severity Vulnerability

Vulnerable Library - spring-webmvc-4.1.6.RELEASE.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-webmvc-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

Publish Date: 2017-05-25

URL: CVE-2016-5007

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2016-5007

Release Date: 2017-05-25

Fix Resolution: org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10247 (Medium) detected in jetty-server-9.4.6.v20170531.jar

CVE-2019-10247 - Medium Severity Vulnerability

Vulnerable Library - jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Publish Date: 2019-04-22

URL: CVE-2019-10247

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577

Release Date: 2019-04-22

Fix Resolution: 9.2.28.v20190418


Step up your Open Source Security Game with WhiteSource here

CVE-2018-9159 (Medium) detected in spark-core-2.7.1.jar

CVE-2018-9159 - Medium Severity Vulnerability

Vulnerable Library - spark-core-2.7.1.jar

A Sinatra inspired java web framework

Library home page: http://www.sparkjava.com

Path to vulnerable library: IntelliMerge/lib/spark-core-2.7.1.jar

Dependency Hierarchy:

  • spark-core-2.7.1.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.

Publish Date: 2018-03-31

URL: CVE-2018-9159

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-9159

Release Date: 2018-03-31

Fix Resolution: 2.7.2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-27216 (High) detected in jetty-webapp-9.4.6.v20170531.jar

CVE-2020-27216 - High Severity Vulnerability

Vulnerable Library - jetty-webapp-9.4.6.v20170531.jar

Jetty web application support

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-webapp-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-webapp-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Publish Date: 2020-10-23

URL: CVE-2020-27216

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921

Release Date: 2020-10-20

Fix Resolution: org.eclipse.jetty:jetty-runner:9.4.33,10.0.0.beta3,11.0.0.beta3;org.eclipse.jetty:jetty-webapp:9.4.33,10.0.0.beta3,11.0.0.beta3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-17571 (High) detected in log4j-1.2.17.jar

CVE-2019-17571 - High Severity Vulnerability

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: IntelliMerge/build.gradle

Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.17/5af35056b4d257e4b64b9e8069c0746e8b08629f/log4j-1.2.17.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.17/5af35056b4d257e4b64b9e8069c0746e8b08629f/log4j-1.2.17.jar

Dependency Hierarchy:

  • slf4j-log4j12-1.7.25.jar (Root Library)
    • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

Release Date: 2019-12-20

Fix Resolution: org.apache.logging.log4j:log4j-core:2.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10241 (Medium) detected in multiple libraries

CVE-2019-10241 - Medium Severity Vulnerability

Vulnerable Libraries - jetty-servlet-9.4.6.v20170531.jar, jetty-util-9.4.6.v20170531.jar, jetty-server-9.4.6.v20170531.jar

jetty-servlet-9.4.6.v20170531.jar

Jetty Servlet Container

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-servlet-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-servlet-9.4.6.v20170531.jar (Vulnerable Library)
jetty-util-9.4.6.v20170531.jar

Utility classes for Jetty

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-util-9.4.6.v20170531.jar (Vulnerable Library)
jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Publish Date: 2019-04-22

URL: CVE-2019-10241

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241

Release Date: 2019-04-22

Fix Resolution: org.eclipse.jetty:jetty-server:9.2.27,9.3.26,9.4.16,org.eclipse.jetty:jetty-servlet:9.2.27,9.3.26,9.4.16,org.eclipse.jetty:jetty-util:9.2.27,9.3.26,9.4.16


Step up your Open Source Security Game with WhiteSource here

test cases failed

Hi, I am recently trying to know more about Intellimerge but as I set up the project I found that most test cases failed because the numbers don't add up. I was wondering if there was something wrong with my setup.
Sincerely hopo to get your response and help.

here are some screenshots.
image
image
image

CVE-2015-3192 (Medium) detected in spring-web-4.1.6.RELEASE.jar

CVE-2015-3192 - Medium Severity Vulnerability

Vulnerable Library - spring-web-4.1.6.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

Publish Date: 2016-07-12

URL: CVE-2015-3192

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3192

Release Date: 2016-07-12

Fix Resolution: org.springframework:spring-web:3.2.14.RELEASE,4.1.7.RELEASE,org.springframework:spring-oxm:3.2.14.RELEASE,4.1.7.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2015-5211 (High) detected in spring-webmvc-4.1.6.RELEASE.jar, spring-web-4.1.6.RELEASE.jar

CVE-2015-5211 - High Severity Vulnerability

Vulnerable Libraries - spring-webmvc-4.1.6.RELEASE.jar, spring-web-4.1.6.RELEASE.jar

spring-webmvc-4.1.6.RELEASE.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-webmvc-4.1.6.RELEASE.jar (Vulnerable Library)
spring-web-4.1.6.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Publish Date: 2017-05-25

URL: CVE-2015-5211

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211

Release Date: 2017-05-25

Fix Resolution: org.springframework:spring-web:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-webmvc:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-websocket:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2018-1271 (Medium) detected in spring-webmvc-4.1.6.RELEASE.jar

CVE-2018-1271 - Medium Severity Vulnerability

Vulnerable Library - spring-webmvc-4.1.6.RELEASE.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar

Dependency Hierarchy:

  • spring-webmvc-4.1.6.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Publish Date: 2018-04-06

URL: CVE-2018-1271

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271

Release Date: 2018-04-06

Fix Resolution: org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE


Step up your Open Source Security Game with WhiteSource here

CVE-2018-12538 (High) detected in jetty-server-9.4.6.v20170531.jar

CVE-2018-12538 - High Severity Vulnerability

Vulnerable Library - jetty-server-9.4.6.v20170531.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar

Dependency Hierarchy:

  • jetty-server-9.4.6.v20170531.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Publish Date: 2018-06-22

URL: CVE-2018-12538

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12538

Release Date: 2018-06-22

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.12.RC0,org.eclipse.jetty:jetty-runner:9.4.12.RC0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0490 (High) detected in jcommander-1.72.jar

WS-2019-0490 - High Severity Vulnerability

Vulnerable Library - jcommander-1.72.jar

Command line parsing

Library home page: http://jcommander.org

Path to dependency file: IntelliMerge/build.gradle

Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/com.beust/jcommander/1.72/6375e521c1e11d6563d4f25a07ce124ccf8cd171/jcommander-1.72.jar

Dependency Hierarchy:

  • jcommander-1.72.jar (Vulnerable Library)

Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57

Found in base branch: master

Vulnerability Details

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Publish Date: 2019-02-19

URL: WS-2019-0490

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cbeust/jcommander#465

Release Date: 2019-02-19

Fix Resolution: com.beust:jcommander:1.75


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.