bitbar / remote-device-client Goto Github PK

Vulnerable Library - hibernate-validator-6.0.17.Final.jar

Hibernate's Bean Validation (JSR-380) reference implementation.

Library home page: http://hibernate.org/validator

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/validator/hibernate-validator/6.0.17.Final/hibernate-validator-6.0.17.Final.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-validation-2.2.0.RELEASE.jar
      • ❌ hibernate-validator-6.0.17.Final.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Publish Date: 2019-11-08

URL: CVE-2019-10219

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10219

Release Date: 2019-11-08

Fix Resolution: 6.0.18.Final

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

• testdroid-api-2.96.jar (Root Library)
  • slf4j-log4j12-1.7.26.jar
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

Release Date: 2019-12-20

Fix Resolution: org.apache.logging.log4j:log4j-core:2.0

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Publish Date: 2019-12-23

URL: CVE-2019-12418

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418

Release Date: 2019-12-23

Fix Resolution: org.apache.tomcat:tomcat-catalina:7.0.98;org.apache.tomcat:tomcat-catalina:8.5.48;org.apache.tomcat:tomcat-catalina:9.0.29;org.apache.tomcat.embed:tomcat-embed-core:9.0.29

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Publish Date: 2021-03-01

URL: CVE-2021-25329

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution: org.apache.tomcat:tomcat:7.0.108, org.apache.tomcat:tomcat:8.5.63, org.apache.tomcat:tomcat:9.0.43,org.apache.tomcat:tomcat:10.0.2

Vulnerable Library - spring-web-5.2.0.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.0.RELEASE/spring-web-5.2.0.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • ❌ spring-web-5.2.0.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Publish Date: 2020-09-19

URL: CVE-2020-5421

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2020-5421

Release Date: 2020-07-21

Fix Resolution: org.springframework:spring-web:5.2.9,org.springframework:spring-web:5.1.18,org.springframework:spring-web:5.0.19,org.springframework:spring-web:4.3.29

Vulnerable Library - httpclient-4.5.6.jar

Apache HttpComponents Client

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.6/httpclient-4.5.6.jar

Dependency Hierarchy:

• testdroid-api-2.96.jar (Root Library)
  • ❌ httpclient-4.5.6.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-07-21

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.13;org.apache.httpcomponents:httpclient-osgi:4.5.13;org.apache.httpcomponents.client5:httpclient5:5.0.3;org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Publish Date: 2021-03-01

URL: CVE-2021-25122

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:8.5.62,9.0.42,10.0.2;org.apache.tomcat:tomcat-coyote:8.5.62,9.0.42,10.0.2

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Publish Date: 2020-02-24

URL: CVE-2020-1935

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-6v7p-v754-j89v

Release Date: 2020-02-24

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.100,8.5.51,9.0.31;org.apache.tomcat:tomcat-coyote:7.0.100,8.5.51,9.0.31

Vulnerable Library - spring-web-5.2.0.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.0.RELEASE/spring-web-5.2.0.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • ❌ spring-web-5.2.0.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Publish Date: 2020-01-17

URL: CVE-2020-5398

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2020-5398

Release Date: 2020-01-17

Fix Resolution: org.springframework:spring-web:5.0.16.RELEASE,org.springframework:spring-web:5.1.13.RELEASE,org.springframework:spring-web:5.2.3.RELEASE

Vulnerable Library - google-oauth-client-1.25.0.jar

Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.

Library home page: https://github.com/google/google-oauth-java-client

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/oauth-client/google-oauth-client/1.25.0/google-oauth-client-1.25.0.jar

Dependency Hierarchy:

• testdroid-api-2.96.jar (Root Library)
  • ❌ google-oauth-client-1.25.0.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

Publish Date: 2020-07-09

URL: CVE-2020-7692

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: googleapis/google-oauth-java-client#470

Release Date: 2020-07-09

Fix Resolution: com.google.oauth-client:google-oauth-client:1.31.0

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Publish Date: 2020-10-12

URL: CVE-2020-13943

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-10-12

Fix Resolution: org.apache.tomcat:tomcat-coyote:8.5.58,9.0.38,10.0.0-M8;org.apache.tomcat.embed:tomcat-embed-core:8.5.58,9.0.38,10.0.0-M8

Vulnerable Library - commons-codec-1.10.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar

Dependency Hierarchy:

• testdroid-api-2.96.jar (Root Library)
  • httpclient-4.5.6.jar
    • ❌ commons-codec-1.10.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Publish Date: 2021-01-14

URL: CVE-2021-24122

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24122

Release Date: 2021-01-14

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.107,8.5.60,9.0.40,10.0.0-M10;org.apache.tomcat:tomcat-catalina:7.0.107,8.5.60,9.0.40,10.0.0-M10

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Publish Date: 2020-06-26

URL: CVE-2020-11996

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E,http://tomcat.apache.org/security-10.html

Release Date: 2020-06-26

Fix Resolution: org.apache.tomcat:tomcat-coyote:10.0.0-M6,9.0.36,8.5.56,org.apache.tomcat.embed:org.apache.tomcat.embed:10.0.0-M6,9.0.36,8.5.56

Vulnerable Library - jackson-databind-2.10.0.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar

Dependency Hierarchy:

• testdroid-api-2.96.jar (Root Library)
  • ❌ jackson-databind-2.10.0.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Publish Date: 2020-12-03

URL: CVE-2020-25649

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2589

Release Date: 2020-12-03

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.4,2.9.10.7,2.10.5.1,2.11.0.rc1

Vulnerable Library - spring-web-5.2.0.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.0.RELEASE/spring-web-5.2.0.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • ❌ spring-web-5.2.0.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: spring-projects/spring-framework#25379

Release Date: 2020-01-02

Fix Resolution: org.springframework:spring-web:5.3.0

Vulnerable Libraries - spring-web-5.2.0.RELEASE.jar, spring-webmvc-5.2.0.RELEASE.jar

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Publish Date: 2020-01-17

URL: CVE-2020-5397

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2020-5397

Release Date: 2020-01-17

Fix Resolution: 5.2.3

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Publish Date: 2020-05-20

URL: CVE-2020-9484

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484

Release Date: 2020-05-20

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.104,8.5.55,9.0.35,10.0.0-M5,org.apache.tomcat:tomcat-catalina:7.0.104,8.5.55,9.0.35,10.0.0-M5

Vulnerable Library - hibernate-validator-6.0.17.Final.jar

Hibernate's Bean Validation (JSR-380) reference implementation.

Library home page: http://hibernate.org/validator

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/validator/hibernate-validator/6.0.17.Final/hibernate-validator-6.0.17.Final.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-validation-2.2.0.RELEASE.jar
      • ❌ hibernate-validator-6.0.17.Final.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Publish Date: 2020-05-06

URL: CVE-2020-10693

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://hibernate.atlassian.net/projects/HV/issues/HV-1774

Release Date: 2020-05-06

Fix Resolution: org.hibernate.validator:hibernate-validator:6.0.20.Final,org.hibernate.validator:hibernate-validator:6.1.5.Final,org.hibernate.validator:hibernate-validator:7.0.0.Alpha2

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Publish Date: 2019-12-23

URL: CVE-2019-17563

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17563

Release Date: 2019-12-23

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.99,8.5.50,9.0.30;org.apache.tomcat:tomcat-catalina:7.0.99,8.5.50,9.0.30

Vulnerable Library - tomcat-embed-websocket-9.0.27.jar

Core Tomcat implementation

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-websocket/9.0.27/tomcat-embed-websocket-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-websocket-9.0.27.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13935

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution: org.apache.tomcat:tomcat-websocket:7.0.105,8.5.57,9.0.37,10.0.0-M7;org.apache.tomcat.embed:tomcat-embed-websocket:7.0.105,8.5.57,9.0.37,10.0.0-M7

Vulnerable Library - tomcat-embed-core-9.0.27.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: remote-device-client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.27/tomcat-embed-core-9.0.27.jar

Dependency Hierarchy:

• spring-boot-starter-websocket-2.2.0.RELEASE.jar (Root Library)
  • spring-boot-starter-web-2.2.0.RELEASE.jar
    • spring-boot-starter-tomcat-2.2.0.RELEASE.jar
      • ❌ tomcat-embed-core-9.0.27.jar (Vulnerable Library)

Found in HEAD commit: 772c0e629e3808cf31104e97f73dbd1621b76476

Found in base branch: master

Vulnerability Details

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13934

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution: org.apache.tomcat:tomcat-coyote:8.5.57,9.0.37,10.0.0-M7;org.apache.tomcat.embed:tomcat-embed-core:8.5.57,9.0.37,10.0.0-M7