temporalio / edu-102-java-code Goto Github PK
View Code? Open in Web Editor NEWCode used in exercises and demonstrations for the "Temporal 102 with Java" course
License: MIT License
Code used in exercises and demonstrations for the "Temporal 102 with Java" course
License: MIT License
Path to dependency file: /exercises/testing-code/solution/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
CVE | Severity | CVSS | Dependency | Type | Fixed in (temporal-sdk version) | Remediation Possible** |
---|---|---|---|---|---|---|
CVE-2023-2976 | High | 7.1 | guava-31.1-jre.jar | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.
Path to dependency file: /exercises/debug-activity/solution/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
Use of Java's default temporary directory for file creation in FileBackedOutputStream
in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Mend Note: Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Publish Date: 2023-06-14
URL: CVE-2023-2976
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-7g45-4rm6-3mm3
Release Date: 2023-06-14
Fix Resolution: com.google.guava:guava:32.0.1-android,32.0.1-jre
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
CVE | Severity | CVSS | Dependency | Type | Fixed in (rapidoid-quick version) | Remediation Possible** |
---|---|---|---|---|---|---|
CVE-2018-14721 | Critical | 10.0 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-14540 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-17531 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-14720 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-16335 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-17267 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2022-41853 | Critical | 9.8 | hsqldb-2.3.3.jar | Transitive | N/A* | ❌ |
CVE-2022-1471 | Critical | 9.8 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2020-8840 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-16942 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-16943 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-10202 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-14893 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-14892 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-9546 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-9547 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-14379 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-9548 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-14719 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-14718 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2017-15095 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2017-7525 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10683 | Critical | 9.8 | dom4j-1.6.1.jar | Transitive | N/A* | ❌ |
CVE-2018-11307 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2017-5929 | Critical | 9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
CVE-2018-19362 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-19361 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-19360 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2017-17485 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-20330 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-7489 | Critical | 9.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
WS-2018-0629 | Critical | 9.1 | woodstox-core-5.0.3.jar | Transitive | N/A* | ❌ |
CVE-2020-11111 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-11113 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-11112 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10672 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10673 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10968 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10969 | High | 8.8 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-11619 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36189 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36188 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-11620 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-10650 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36181 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36180 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36183 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36182 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-5968 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36185 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36184 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36187 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36186 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2021-20190 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-14060 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-14061 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-14062 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-14195 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-36179 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-24616 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-24750 | High | 8.1 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-12086 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-12022 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2018-12023 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-14439 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
WS-2017-3805 | High | 7.5 | json-20140107.jar | Transitive | N/A* | ❌ |
CVE-2022-25857 | High | 7.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2020-36518 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2022-40152 | High | 7.5 | woodstox-core-5.0.3.jar | Transitive | N/A* | ❌ |
CVE-2022-45688 | High | 7.5 | json-20140107.jar | Transitive | N/A* | ❌ |
CVE-2017-18640 | High | 7.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2018-1000632 | High | 7.5 | dom4j-1.6.1.jar | Transitive | N/A* | ❌ |
CVE-2022-42004 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2022-42003 | High | 7.5 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-25638 | High | 7.4 | hibernate-core-4.3.11.Final.jar | Transitive | N/A* | ❌ |
CVE-2017-7536 | High | 7.0 | hibernate-validator-5.2.4.Final.jar | Transitive | N/A* | ❌ |
CVE-2022-21363 | Medium | 6.6 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2021-42550 | Medium | 6.6 | detected in multiple dependencies | Transitive | N/A* | ❌ |
WS-2019-0379 | Medium | 6.5 | commons-codec-1.9.jar | Transitive | N/A* | ❌ |
CVE-2022-41854 | Medium | 6.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2019-14900 | Medium | 6.5 | hibernate-core-4.3.11.Final.jar | Transitive | N/A* | ❌ |
CVE-2022-38752 | Medium | 6.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2022-38751 | Medium | 6.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2022-38749 | Medium | 6.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
CVE-2017-3586 | Medium | 6.4 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2019-2692 | Medium | 6.3 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2019-12814 | Medium | 5.9 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2019-12384 | Medium | 5.9 | jackson-databind-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2022-38750 | Medium | 5.5 | snakeyaml-1.17.jar | Transitive | N/A* | ❌ |
WS-2018-0124 | Medium | 5.3 | jackson-core-2.8.5.jar | Transitive | N/A* | ❌ |
CVE-2020-13956 | Medium | 5.3 | httpclient-4.4.1.jar | Transitive | N/A* | ❌ |
CVE-2020-10693 | Medium | 5.3 | hibernate-validator-5.2.4.Final.jar | Transitive | N/A* | ❌ |
WS-2017-3734 | Medium | 5.3 | httpclient-4.4.1.jar | Transitive | N/A* | ❌ |
CVE-2020-2934 | Medium | 5.0 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2020-2875 | Medium | 4.7 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2017-3589 | Low | 3.3 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
CVE-2020-2933 | Low | 2.2 | mysql-connector-java-5.1.41.jar | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Partial details (16 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14721
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14721
Release Date: 2019-01-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7,2.8.11.3,2.7.9.5,2.6.7.3
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Publish Date: 2019-09-15
URL: CVE-2019-14540
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540
Release Date: 2019-09-15
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10,2.10.0.pr3,2.11.0.rc1
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Publish Date: 2019-10-12
URL: CVE-2019-17531
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531
Release Date: 2019-10-12
Fix Resolution: 2.10
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14720
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14720
Release Date: 2019-01-02
Fix Resolution: 2.9.7
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Publish Date: 2019-09-15
URL: CVE-2019-16335
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-09-15
Fix Resolution: 2.9.10
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Publish Date: 2019-10-07
URL: CVE-2019-17267
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-10-07
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10
HSQLDB - Lightweight 100% Java SQL Database Engine
Library home page: http://hsqldb.org
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hsqldb/hsqldb/2.3.3/hsqldb-2.3.3.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Publish Date: 2022-10-06
URL: CVE-2022-41853
Base Score Metrics:
YAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.17/snakeyaml-1.17.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Publish Date: 2022-12-01
URL: CVE-2022-1471
Base Score Metrics:
Type: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
Release Date: 2022-12-01
Fix Resolution: org.yaml:snakeyaml:2.0
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Publish Date: 2020-02-10
URL: CVE-2020-8840
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-02-10
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.3
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Publish Date: 2019-10-01
URL: CVE-2019-16942
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942
Release Date: 2019-10-01
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Publish Date: 2019-10-01
URL: CVE-2019-16943
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943
Release Date: 2019-10-01
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Publish Date: 2019-10-01
URL: CVE-2019-10202
Base Score Metrics:
Type: Upgrade version
Origin: https://lists.apache.org/thread/08302h5kp2l9ry2zq8vydomlhn0fg4j4
Release Date: 2019-10-01
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.0.0
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping()
or when @JsonTypeInfo is using Id.CLASS
or Id.MINIMAL_CLASS
or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Publish Date: 2020-03-02
URL: CVE-2019-14893
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14893
Release Date: 2020-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Publish Date: 2020-03-02
URL: CVE-2019-14892
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
Publish Date: 2020-03-02
URL: CVE-2020-9546
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546
Release Date: 2020-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /utilities/microservice/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.5/jackson-databind-2.8.5.jar
Dependency Hierarchy:
Found in HEAD commit: 4cfd2b23479db4c7e0ca93f5af7feccfb0111abb
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Publish Date: 2020-03-02
URL: CVE-2020-9547
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547
Release Date: 2020-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.