symbolk / intellimerge Goto Github PK
View Code? Open in Web Editor NEWA graph-based refactoring-aware three-way merging tool for Java programs.
License: MIT License
A graph-based refactoring-aware three-way merging tool for Java programs.
License: MIT License
Utility classes for Jetty
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Publish Date: 2017-06-16
URL: CVE-2017-9735
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784
Release Date: 2017-06-16
Fix Resolution: 9.4.7.RC0
Step up your Open Source Security Game with WhiteSource here
Library home page: http://archive.apache.org/dist/cxf/2.7.17/apache-cxf-2.7.17.zip
Path to vulnerable library: IntelliMerge/lib/commons-codec-1.10.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.
Publish Date: 2019-05-20
URL: WS-2019-0379
Base Score Metrics:
Type: Upgrade version
Origin: apache/commons-codec@48b6157
Release Date: 2019-05-20
Fix Resolution: commons-codec:commons-codec:1.13
Step up your Open Source Security Game with WhiteSource here
Jetty web application support
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-webapp-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
Publish Date: 2020-10-23
URL: CVE-2020-27216
Base Score Metrics:
Type: Upgrade version
Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921
Release Date: 2020-10-20
Fix Resolution: org.eclipse.jetty:jetty-runner:9.4.33,10.0.0.beta3,11.0.0.beta3;org.eclipse.jetty:jetty-webapp:9.4.33,10.0.0.beta3,11.0.0.beta3
Step up your Open Source Security Game with WhiteSource here
I reproduced the motivating example from the paper in https://github.com/benedikt-schesch/intellimerge-example but intellimerge does raise a merge conflict. Is that expected behavior or is there a bug?
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: https://github.com/google/guava
Path to dependency file: IntelliMerge/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/27.0.1-jre/bd41a290787b5301e63929676d792c507bbc00ae/guava-27.0.1-jre.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Publish Date: 2020-12-10
URL: CVE-2020-8908
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
Release Date: 2020-12-10
Fix Resolution: v30.0
Step up your Open Source Security Game with WhiteSource here
The Eclipse Jetty Project
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar
Dependency Hierarchy:
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Publish Date: 2018-06-26
URL: CVE-2017-7657
Base Score Metrics:
Type: Upgrade version
Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668
Release Date: 2018-06-26
Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605;org.eclipse.jetty:jetty-http:9.3.24.v20180605,9.4.11.v20180605
Step up your Open Source Security Game with WhiteSource here
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.
Publish Date: 2020-01-02
URL: CVE-2016-1000027
Base Score Metrics:
Type: Change files
Origin: spring-projects/spring-framework@76964e1
Release Date: 2016-05-03
Fix Resolution: Replace or update the following files: HttpInvokerProxyFactoryBean.java, HttpInvokerServiceExporter.java
Step up your Open Source Security Game with WhiteSource here
Command line parsing
Library home page: http://jcommander.org
Path to dependency file: IntelliMerge/build.gradle
Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/com.beust/jcommander/1.72/6375e521c1e11d6563d4f25a07ce124ccf8cd171/jcommander-1.72.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.
Publish Date: 2019-02-19
URL: WS-2019-0490
Base Score Metrics:
Type: Upgrade version
Origin: cbeust/jcommander#465
Release Date: 2019-02-19
Fix Resolution: com.beust:jcommander:1.75
Step up your Open Source Security Game with WhiteSource here
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Publish Date: 2019-04-22
URL: CVE-2019-10247
Base Score Metrics:
Type: Upgrade version
Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577
Release Date: 2019-04-22
Fix Resolution: 9.2.28.v20190418
Step up your Open Source Security Game with WhiteSource here
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Publish Date: 2018-06-22
URL: CVE-2018-12538
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12538
Release Date: 2018-06-22
Fix Resolution: org.eclipse.jetty:jetty-server:9.4.12.RC0,org.eclipse.jetty:jetty-runner:9.4.12.RC0
Step up your Open Source Security Game with WhiteSource here
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Publish Date: 2016-07-12
URL: CVE-2015-3192
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3192
Release Date: 2016-07-12
Fix Resolution: org.springframework:spring-web:3.2.14.RELEASE,4.1.7.RELEASE,org.springframework:spring-oxm:3.2.14.RELEASE,4.1.7.RELEASE
Step up your Open Source Security Game with WhiteSource here
The Eclipse Jetty Project
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar
Dependency Hierarchy:
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Publish Date: 2018-06-26
URL: CVE-2017-7658
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658
Release Date: 2018-06-26
Fix Resolution: org.eclipse.jetty:jetty-server:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty.aggregate:jetty-client:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty:jetty-http:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606
Step up your Open Source Security Game with WhiteSource here
Spring Web MVC
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar
Dependency Hierarchy:
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Publish Date: 2017-05-25
URL: CVE-2015-5211
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211
Release Date: 2017-05-25
Fix Resolution: org.springframework:spring-web:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-webmvc:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-websocket:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE
Step up your Open Source Security Game with WhiteSource here
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Publish Date: 2020-11-28
URL: CVE-2020-27218
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-86wm-rrjm-8wh8
Release Date: 2020-11-28
Fix Resolution: org.eclipse.jetty:jetty-server:9.4.35.v20201120, 10.0.0.beta3, 11.0.0.beta3
Step up your Open Source Security Game with WhiteSource here
Spring Core
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-core-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Publish Date: 2018-03-16
URL: CVE-2018-1199
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1199
Release Date: 2018-03-16
Fix Resolution: org.springframework.security:spring-security-web:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework.security:spring-security-config:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework:spring-core:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,4.3.14.RELEASE
Step up your Open Source Security Game with WhiteSource here
Apache Log4j 1.2
Path to dependency file: IntelliMerge/build.gradle
Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.17/5af35056b4d257e4b64b9e8069c0746e8b08629f/log4j-1.2.17.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.17/5af35056b4d257e4b64b9e8069c0746e8b08629f/log4j-1.2.17.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Publish Date: 2019-12-20
URL: CVE-2019-17571
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
Release Date: 2019-12-20
Fix Resolution: org.apache.logging.log4j:log4j-core:2.0
Step up your Open Source Security Game with WhiteSource here
Jetty Servlet Container
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-servlet-9.4.6.v20170531.jar
Dependency Hierarchy:
Utility classes for Jetty
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar
Dependency Hierarchy:
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Publish Date: 2019-04-22
URL: CVE-2019-10241
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241
Release Date: 2019-04-22
Fix Resolution: org.eclipse.jetty:jetty-server:9.2.27,9.3.26,9.4.16,org.eclipse.jetty:jetty-servlet:9.2.27,9.3.26,9.4.16,org.eclipse.jetty:jetty-util:9.2.27,9.3.26,9.4.16
Step up your Open Source Security Game with WhiteSource here
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Publish Date: 2020-09-19
URL: CVE-2020-5421
Base Score Metrics:
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2020-5421
Release Date: 2020-07-21
Fix Resolution: org.springframework:spring-web:5.2.9,org.springframework:spring-web:5.1.18,org.springframework:spring-web:5.0.19,org.springframework:spring-web:4.3.29
Step up your Open Source Security Game with WhiteSource here
Spring Web MVC
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
Publish Date: 2017-05-25
URL: CVE-2016-5007
Base Score Metrics:
Type: Upgrade version
Origin: https://pivotal.io/security/cve-2016-5007
Release Date: 2017-05-25
Fix Resolution: org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE
Step up your Open Source Security Game with WhiteSource here
Jetty Servlet Container
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-servlet-9.4.6.v20170531.jar
Dependency Hierarchy:
Utility classes for Jetty
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-util-9.4.6.v20170531.jar
Dependency Hierarchy:
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Publish Date: 2018-06-27
URL: CVE-2018-12536
Base Score Metrics:
Type: Upgrade version
Origin: jetty/jetty.project@ad4dceb
Release Date: 2018-06-27
Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-util:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-servlet:9.3.24.v20180605,9.4.11.v20180605
Step up your Open Source Security Game with WhiteSource here
To be removed:
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-web-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Publish Date: 2018-04-06
URL: CVE-2018-1272
Base Score Metrics:
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2018-1272
Release Date: 2018-04-06
Fix Resolution: org.springframework:spring-core:4.3.15.RELEASE,5.0.5.RELEASE;org.springframework:spring-web:4.3.15.RELEASE,5.0.5.RELEASE
Step up your Open Source Security Game with WhiteSource here
Spring Web MVC
Library home page: https://github.com/spring-projects/spring-framework
Path to vulnerable library: IntelliMerge/lib/spring-webmvc-4.1.6.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Publish Date: 2018-04-06
URL: CVE-2018-1271
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271
Release Date: 2018-04-06
Fix Resolution: org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE
Step up your Open Source Security Game with WhiteSource here
A Sinatra inspired java web framework
Library home page: http://www.sparkjava.com
Path to vulnerable library: IntelliMerge/lib/spark-core-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Publish Date: 2018-03-31
URL: CVE-2018-9159
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-9159
Release Date: 2018-03-31
Fix Resolution: 2.7.2
Step up your Open Source Security Game with WhiteSource here
The Eclipse Jetty Project
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-http-9.4.6.v20170531.jar
Dependency Hierarchy:
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: IntelliMerge/lib/jetty-server-9.4.6.v20170531.jar
Dependency Hierarchy:
Found in HEAD commit: 56734b71678ef12792f18286f37ede2d85d65a57
Found in base branch: master
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Publish Date: 2018-06-26
URL: CVE-2017-7656
Base Score Metrics:
Type: Upgrade version
Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667
Release Date: 2018-06-26
Fix Resolution: org.eclipse.jetty:jetty-server:9.2.25.v20180606,9.3.24.v20180605,9.4.11.v20180605;org.eclipse.jetty:jetty-http:9.2.25.v20180606.,9.3.24.v20180605,9.4.11.v20180605
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.