Giter Club home page Giter Club logo

cityai's Introduction

CityAI Microservice Project

Welcome to the CityAI Microservice Project! This project aims to provide a scalable and modular solution for managing various aspects of a city's operations through the use of microservices. Each microservice focuses on a specific domain within a city, enabling easy integration, deployment, and maintenance.

Table of Contents

  1. Introduction
  2. Features
  3. Getting Started
  4. Usage
  5. API Documentation
  6. Contributing
  7. License

Introduction

CityAI Microservice Project is designed to address the challenges faced by modern cities in managing diverse systems and processes. By breaking down complex city operations into smaller, specialized microservices, this project provides a scalable and flexible architecture that can be extended and customized based on specific city requirements.

The project follows a microservice-based approach, where each microservice focuses on a specific domain, such as transportation, waste management, energy optimization, public safety, or urban planning. This allows individual services to be developed, deployed, and scaled independently, promoting better maintainability and agility.

Features

The CityAI Microservice Project offers the following key features:

  1. Modularity: Each microservice operates independently, allowing for easy integration and maintenance.
  2. Scalability: Services can be scaled individually based on demand, ensuring efficient resource utilization.
  3. Flexibility: The project provides an extensible architecture, enabling the addition of new services and integration with existing systems.
  4. Interoperability: Microservices communicate through well-defined APIs, enabling seamless data exchange between different domains.
  5. Real-time Data Processing: The project incorporates real-time data processing capabilities, enabling efficient decision-making and response to city events.
  6. Analytics and Insights: Services provide analytics and insights to aid city administrators in making data-driven decisions.

Getting Started

To get started with the CityAI Microservice Project, follow the instructions below.

Prerequisites

  1. Operating System: The project is compatible with Windows, macOS, and Linux.
  2. Node.js: Ensure that Node.js is installed on your system. You can download it from https://nodejs.org.
  3. Package Manager: The project uses npm as the package manager. npm is bundled with Node.js.

Installation

  1. Clone the project repository:

    git clone https://github.com/cityai-microservices/cityai.git
  2. Navigate to the project directory:

    cd cityai
  3. Install the project dependencies:

    npm install

Usage

To start using the CityAI Microservice Project, follow these steps:

  1. Start the desired microservice by running the following command:

    npm run start:<microservice-name>
  2. Access the microservice API through the provided endpoint. Refer to the API documentation for details on available endpoints and request/response formats.

  3. Integrate the microservice with other services or systems as required, using the provided API.

API Documentation

For detailed information about the API endpoints and their functionalities, refer to the API documentation.

Contributing

Contributions to the CityAI Microservice Project are welcome! If you want to contribute, please follow the guidelines outlined in the CONTRIBUTING.md file.

License

The CityAI Microservice Project is licensed under the MIT License. For more information, please refer to the LICENSE file.

Roadmap

The future development of the CityAI Microservice Project includes the following planned features and enhancements:

  • Integration with IoT devices for real-time data collection.
  • Implementation of advanced analytics and machine learning algorithms for predictive insights.
  • Enhancements to security measures, including authentication and authorization mechanisms.
  • Integration with external data sources and APIs to enrich the functionality and data coverage.
  • Continuous integration and deployment pipelines for automated testing and deployment.
  • Development of a web-based dashboard for monitoring and managing microservices.
  • Support for containerization technologies, such as Docker and Kubernetes, for easier deployment and scalability.

We welcome contributions and ideas from the community to help shape the future direction of the project.

Support

If you encounter any issues or have questions regarding the CityAI Microservice Project, please feel free to open an issue on the project repository. We will be glad to assist you.

Acknowledgments

We would like to express our gratitude to the open-source community for their invaluable contributions and inspirations that have made this project possible. We also extend our thanks to all the developers and organizations whose libraries, frameworks, and tools are utilized in this project.

About

The CityAI Microservice Project is developed and maintained by a team of passionate developers dedicated to creating innovative solutions for urban management. It is an open-source project aimed at empowering cities with intelligent and efficient systems.

For more information about the project and its contributors, visit the official website.

Stay Connected

To stay updated with the latest news and announcements regarding the CityAI Microservice Project, you can:

We encourage you to engage with the community, share your feedback, and contribute to the project's growth and success.

Thank you for choosing the CityAI Microservice Project! We hope it provides valuable solutions for managing and improving cities.

Project Structure

Node is required for generation and recommended for development. package.json is always generated for a better development experience with prettier, commit hooks, scripts and so on.

In the project root, JHipster generates configuration files for tools like git, prettier, eslint, husky, and others that are well known and you can find references in the web.

/src/* structure follows default Java structure.

  • .yo-rc.json - Yeoman configuration file JHipster configuration is stored in this file at generator-jhipster key. You may find generator-jhipster-* for specific blueprints configuration.

  • .yo-resolve (optional) - Yeoman conflict resolver Allows to use a specific action when conflicts are found skipping prompts for files that matches a pattern. Each line should match [pattern] [action] with pattern been a Minimatch pattern and action been one of skip (default if ommited) or force. Lines starting with # are considered comments and are ignored.

  • .jhipster/*.json - JHipster entity configuration files

  • npmw - wrapper to use locally installed npm. JHipster installs Node and npm locally using the build tool by default. This wrapper makes sure npm is installed locally and uses it avoiding some differences different versions can cause. By using ./npmw instead of the traditional npm you can configure a Node-less environment to develop or test your application.

  • /src/main/docker - Docker configurations for the application and services that the application depends on

Development

Before you can build this project, you must install and configure the following dependencies on your machine:

  1. Node.js: We use Node to run a development web server and build the project. Depending on your system, you can install Node either from source or as a pre-packaged bundle.

After installing Node, you should be able to run the following command to install development tools. You will only need to run this command when dependencies change in package.json.

npm install

We use npm scripts and Angular CLI with Webpack as our build system.

If you are using hazelcast as a cache, you will have to launch a cache server. To start your cache server, run:

docker compose -f src/main/docker/hazelcast-management-center.yml up -d

Run the following commands in two separate terminals to create a blissful development experience where your browser auto-refreshes when files change on your hard drive.

./mvnw
npm start

Npm is also used to manage CSS and JavaScript dependencies used in this application. You can upgrade dependencies by specifying a newer version in package.json. You can also run npm update and npm install to manage dependencies. Add the help flag on any command to see how you can use it. For example, npm help update.

The npm run command will list all of the scripts available to run for this project.

PWA Support

JHipster ships with PWA (Progressive Web App) support, and it's turned off by default. One of the main components of a PWA is a service worker.

The service worker initialization code is disabled by default. To enable it, uncomment the following code in src/main/webapp/app/app.module.ts:

ServiceWorkerModule.register('ngsw-worker.js', { enabled: false }),

Managing dependencies

For example, to add Leaflet library as a runtime dependency of your application, you would run following command:

npm install --save --save-exact leaflet

To benefit from TypeScript type definitions from DefinitelyTyped repository in development, you would run following command:

npm install --save-dev --save-exact @types/leaflet

Then you would import the JS and CSS files specified in library's installation instructions so that Webpack knows about them: Edit src/main/webapp/app/app.module.ts file:

import 'leaflet/dist/leaflet.js';

Edit src/main/webapp/content/scss/vendor.scss file:

@import 'leaflet/dist/leaflet.css';

Note: There are still a few other things remaining to do for Leaflet that we won't detail here.

For further instructions on how to develop with JHipster, have a look at Using JHipster in development.

Developing Microfrontend

Microservices doesn't contain every required backend feature to allow microfrontends to run alone. You must start a pre-built gateway version or from source.

Start gateway from source:

cd gateway
npm run docker:db:up # start database if necessary
npm run docker:others:up # start service discovery and authentication service if necessary
npm run app:start # alias for ./(mvnw|gradlew)

Microfrontend's build-watch script is configured to watch and compile microfrontend's sources and synchronizes with gateway's frontend. Start it using:

cd microfrontend
npm run docker:db:up # start database if necessary
npm run build-watch

It's possible to run microfrontend's frontend standalone using:

cd microfrontend
npm run docker:db:up # start database if necessary
npm watch # alias for `npm start` and `npm run backend:start` in parallel

Using Angular CLI

You can also use Angular CLI to generate some custom client code.

For example, the following command:

ng generate component my-component

will generate few files:

create src/main/webapp/app/my-component/my-component.component.html
create src/main/webapp/app/my-component/my-component.component.ts
update src/main/webapp/app/app.module.ts

JHipster Control Center

JHipster Control Center can help you manage and control your application(s). You can start a local control center server (accessible on http://localhost:7419) with:

docker compose -f src/main/docker/jhipster-control-center.yml up

Doing API-First development using openapi-generator-cli

OpenAPI-Generator is configured for this application. You can generate API code from the src/main/resources/swagger/api.yml definition file by running:

./mvnw generate-sources

Then implements the generated delegate classes with @Service classes.

To edit the api.yml definition file, you can use a tool such as Swagger-Editor. Start a local instance of the swagger-editor using docker by running: docker compose -f src/main/docker/swagger-editor.yml up -d. The editor will then be reachable at http://localhost:7742.

Refer to Doing API-First development for more details.

Building for production

Packaging as jar

To build the final jar and optimize the CityAi application for production, run:

./mvnw -Pprod clean verify

This will concatenate and minify the client CSS and JavaScript files. It will also modify index.html so it references these new files. To ensure everything worked, run:

java -jar target/*.jar

Then navigate to http://localhost:8081 in your browser.

Refer to Using JHipster in production for more details.

Packaging as war

To package your application as a war in order to deploy it to an application server, run:

./mvnw -Pprod,war clean verify

Testing

To launch your application's tests, run:

./mvnw verify

Client tests

Unit tests are run by Jest. They're located in src/test/javascript/ and can be run with:

npm test

Other tests

Performance tests are run by Gatling and written in Scala. They're located in src/test/java/gatling/simulations.

You can execute all Gatling tests with

./mvnw gatling:test

For more information, refer to the Running tests page.

Code quality

Sonar is used to analyse code quality. You can start a local Sonar server (accessible on http://localhost:9001) with:

docker compose -f src/main/docker/sonar.yml up -d

Note: we have turned off forced authentication redirect for UI in src/main/docker/sonar.yml for out of the box experience while trying out SonarQube, for real use cases turn it back on.

You can run a Sonar analysis with using the sonar-scanner or by using the maven plugin.

Then, run a Sonar analysis:

./mvnw -Pprod clean verify sonar:sonar -Dsonar.login=admin -Dsonar.password=admin

If you need to re-run the Sonar phase, please be sure to specify at least the initialize phase since Sonar properties are loaded from the sonar-project.properties file.

./mvnw initialize sonar:sonar -Dsonar.login=admin -Dsonar.password=admin

Additionally, Instead of passing sonar.password and sonar.login as CLI arguments, these parameters can be configured from sonar-project.properties as shown below:

sonar.login=admin
sonar.password=admin

For more information, refer to the Code quality page.

Using Docker to simplify development (optional)

You can use Docker to improve your JHipster development experience. A number of docker-compose configuration are available in the src/main/docker folder to launch required third party services.

For example, to start a postgresql database in a docker container, run:

docker compose -f src/main/docker/postgresql.yml up -d

To stop it and remove the container, run:

docker compose -f src/main/docker/postgresql.yml down

You can also fully dockerize your application and all the services that it depends on. To achieve this, first build a docker image of your app by running:

npm run java:docker

Or build a arm64 docker image when using an arm64 processor os like MacOS with M1 processor family running:

npm run java:docker:arm64

Then run:

docker compose -f src/main/docker/app.yml up -d

When running Docker Desktop on MacOS Big Sur or later, consider enabling experimental Use the new Virtualization framework for better processing performance (disk access performance is worse).

For more information refer to Using Docker and Docker-Compose, this page also contains information on the docker-compose sub-generator (jhipster docker-compose), which is able to generate docker configurations for one or several JHipster applications.

Continuous Integration (optional)

To configure CI for your project, run the ci-cd sub-generator (jhipster ci-cd), this will let you generate configuration files for a number of Continuous Integration systems. Consult the Setting up Continuous Integration page for more information.

cityai's People

Contributors

jhipster-bot avatar kosasih avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar  avatar

cityai's Issues

localize-16.0.5.tgz: 2 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - localize-16.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/helper-compilation-targets/node_modules/semver/package.json,/node_modules/@angular/localize/node_modules/semver/package.json

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (localize version) Remediation Possible**
CVE-2023-45133 High 8.8 traverse-7.22.5.tgz Transitive 16.0.6
CVE-2022-25883 High 7.5 semver-6.3.0.tgz Transitive 16.2.10

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133

Vulnerable Library - traverse-7.22.5.tgz

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.22.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/traverse/package.json

Dependency Hierarchy:

  • localize-16.0.5.tgz (Root Library)
    • core-7.21.8.tgz
      • traverse-7.22.5.tgz (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (@angular/localize): 16.0.6

Step up your Open Source Security Game with Mend here

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/helper-compilation-targets/node_modules/semver/package.json,/node_modules/@angular/localize/node_modules/semver/package.json

Dependency Hierarchy:

  • localize-16.0.5.tgz (Root Library)
    • core-7.21.8.tgz
      • semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (@angular/localize): 16.2.10

Step up your Open Source Security Game with Mend here

spring-cloud-starter-openfeign-4.0.3.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-openfeign-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter-openfeign version) Remediation Possible**
CVE-2023-24998 High 7.5 commons-fileupload-1.4.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-24998

Vulnerable Library - commons-fileupload-1.4.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: http://commons.apache.org/proper/commons-fileupload/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-openfeign-4.0.3.jar (Root Library)
    • spring-cloud-openfeign-core-4.0.3.jar
      • feign-form-spring-3.8.0.jar
        • commons-fileupload-1.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Publish Date: 2023-02-20

URL: CVE-2023-24998

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-10.html

Release Date: 2023-02-20

Fix Resolution: commons-fileupload:commons-fileupload:1.5;org.apache.tomcat:tomcat-coyote:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat.embed:tomcat-embed-core:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat:tomcat-util:8.5.85,9.0.71,10.1.5,11.0.0-M3;org.apache.tomcat:tomcat-catalina:8.5.85,9.0.71,10.1.5,11.0.0-M3

Step up your Open Source Security Game with Mend here

h2-2.1.214.jar: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - h2-2.1.214.jar

H2 Database Engine

Library home page: https://h2database.com

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (h2 version) Remediation Possible**
CVE-2022-45868 High 7.8 h2-2.1.214.jar Direct 2.2.220

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-45868

Vulnerable Library - h2-2.1.214.jar

H2 Database Engine

Library home page: https://h2database.com

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar

Dependency Hierarchy:

  • h2-2.1.214.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

Publish Date: 2022-11-23

URL: CVE-2022-45868

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-22wj-vf5f-wrvj

Release Date: 2022-11-23

Fix Resolution: 2.2.220

Step up your Open Source Security Game with Mend here

hazelcast-hibernate53-5.0.0.jar: 3 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - hazelcast-hibernate53-5.0.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/hazelcast/hazelcast/5.1.6/hazelcast-5.1.6.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (hazelcast-hibernate53 version) Remediation Possible**
CVE-2023-33265 High 8.8 hazelcast-5.1.6.jar Transitive N/A*
CVE-2023-45859 High 7.6 hazelcast-5.1.6.jar Transitive N/A*
CVE-2023-45860 Medium 6.5 hazelcast-5.1.6.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-33265

Vulnerable Library - hazelcast-5.1.6.jar

Core Hazelcast Module

Library home page: http://www.hazelcast.com/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/hazelcast/hazelcast/5.1.6/hazelcast-5.1.6.jar

Dependency Hierarchy:

  • hazelcast-hibernate53-5.0.0.jar (Root Library)
    • hazelcast-5.1.6.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

Publish Date: 2023-07-18

URL: CVE-2023-33265

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265

Release Date: 2023-07-18

Fix Resolution: com.hazelcast:hazelcast:5.0.5,5.1.7,5.2.4

Step up your Open Source Security Game with Mend here

CVE-2023-45859

Vulnerable Library - hazelcast-5.1.6.jar

Core Hazelcast Module

Library home page: http://www.hazelcast.com/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/hazelcast/hazelcast/5.1.6/hazelcast-5.1.6.jar

Dependency Hierarchy:

  • hazelcast-hibernate53-5.0.0.jar (Root Library)
    • hazelcast-5.1.6.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.

Publish Date: 2024-02-28

URL: CVE-2023-45859

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xh6m-7cr7-xx66

Release Date: 2024-02-28

Fix Resolution: com.hazelcast:hazelcast:5.2.5,5.3.5

Step up your Open Source Security Game with Mend here

CVE-2023-45860

Vulnerable Library - hazelcast-5.1.6.jar

Core Hazelcast Module

Library home page: http://www.hazelcast.com/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/hazelcast/hazelcast/5.1.6/hazelcast-5.1.6.jar

Dependency Hierarchy:

  • hazelcast-hibernate53-5.0.0.jar (Root Library)
    • hazelcast-5.1.6.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.

Publish Date: 2024-02-16

URL: CVE-2023-45860

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8h4x-xvjp-vf99

Release Date: 2024-02-16

Fix Resolution: com.hazelcast:hazelcast:5.3.5

Step up your Open Source Security Game with Mend here

spring-boot-starter-undertow-3.0.7.jar: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-undertow-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-servlet/2.3.6.Final/undertow-servlet-2.3.6.Final.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-undertow version) Remediation Possible**
CVE-2024-1635 High 7.5 undertow-core-2.3.6.Final.jar Transitive 3.1.9
CVE-2023-5685 High 7.5 xnio-api-3.8.8.Final.jar Transitive N/A*
CVE-2023-3223 High 7.5 undertow-servlet-2.3.6.Final.jar Transitive 3.0.8
CVE-2023-4639 High 7.4 undertow-core-2.3.6.Final.jar Transitive 3.1.9

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-1635

Vulnerable Library - undertow-core-2.3.6.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.6.Final/undertow-core-2.3.6.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.0.7.jar (Root Library)
    • undertow-core-2.3.6.Final.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.

At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Publish Date: 2024-02-19

URL: CVE-2024-1635

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=2264928

Release Date: 2024-02-19

Fix Resolution (io.undertow:undertow-core): 2.3.11.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-undertow): 3.1.9

Step up your Open Source Security Game with Mend here

CVE-2023-5685

Vulnerable Library - xnio-api-3.8.8.Final.jar

The API JAR of the XNIO project

Library home page: http://www.jboss.org/xnio

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jboss/xnio/xnio-api/3.8.8.Final/xnio-api-3.8.8.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.0.7.jar (Root Library)
    • undertow-core-2.3.6.Final.jar
      • xnio-api-3.8.8.Final.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

Publish Date: 2024-03-22

URL: CVE-2023-5685

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-3223

Vulnerable Library - undertow-servlet-2.3.6.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-servlet/2.3.6.Final/undertow-servlet-2.3.6.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.0.7.jar (Root Library)
    • undertow-servlet-2.3.6.Final.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Publish Date: 2023-09-27

URL: CVE-2023-3223

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=2209689

Release Date: 2023-09-27

Fix Resolution (io.undertow:undertow-servlet): 2.3.7.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-undertow): 3.0.8

Step up your Open Source Security Game with Mend here

CVE-2023-4639

Vulnerable Library - undertow-core-2.3.6.Final.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/undertow/undertow-core/2.3.6.Final/undertow-core-2.3.6.Final.jar

Dependency Hierarchy:

  • spring-boot-starter-undertow-3.0.7.jar (Root Library)
    • undertow-core-2.3.6.Final.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Publish Date: 2023-08-30

URL: CVE-2023-4639

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-4639

Release Date: 2023-08-30

Fix Resolution (io.undertow:undertow-core): 2.3.11.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-undertow): 3.1.9

Step up your Open Source Security Game with Mend here

spring-boot-starter-oauth2-resource-server-3.0.7.jar: 5 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - spring-boot-starter-oauth2-resource-server-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/6.0.2/spring-security-core-6.0.2.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-oauth2-resource-server version) Remediation Possible**
CVE-2023-34034 Critical 9.8 spring-security-config-6.0.2.jar Transitive 3.0.9
CVE-2024-22257 High 8.2 spring-security-core-6.0.2.jar Transitive 3.2.4
CVE-2023-52428 High 7.5 nimbus-jose-jwt-9.24.4.jar Transitive N/A*
CVE-2023-20863 Medium 6.5 spring-expression-6.0.7.jar Transitive 3.0.8
CVE-2023-34035 Medium 5.3 spring-security-config-6.0.2.jar Transitive 3.0.9

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34034

Vulnerable Library - spring-security-config-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.2/spring-security-config-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-resource-server-3.0.7.jar (Root Library)
    • spring-security-config-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.

Publish Date: 2023-07-19

URL: CVE-2023-34034

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34034

Release Date: 2023-07-19

Fix Resolution (org.springframework.security:spring-security-config): 6.0.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-resource-server): 3.0.9

Step up your Open Source Security Game with Mend here

CVE-2024-22257

Vulnerable Library - spring-security-core-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/6.0.2/spring-security-core-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-resource-server-3.0.7.jar (Root Library)
    • spring-security-core-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Publish Date: 2024-03-18

URL: CVE-2024-22257

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22257

Release Date: 2024-03-18

Fix Resolution (org.springframework.security:spring-security-core): 6.2.3

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-resource-server): 3.2.4

Step up your Open Source Security Game with Mend here

CVE-2023-52428

Vulnerable Library - nimbus-jose-jwt-9.24.4.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/nimbusds/nimbus-jose-jwt/9.24.4/nimbus-jose-jwt-9.24.4.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-resource-server-3.0.7.jar (Root Library)
    • spring-security-oauth2-jose-6.0.2.jar
      • nimbus-jose-jwt-9.24.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Publish Date: 2024-02-11

URL: CVE-2023-52428

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428

Release Date: 2024-02-11

Fix Resolution: com.nimbusds:nimbus-jose-jwt:9.37.2

Step up your Open Source Security Game with Mend here

CVE-2023-20863

Vulnerable Library - spring-expression-6.0.7.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/6.0.7/spring-expression-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-resource-server-3.0.7.jar (Root Library)
    • spring-security-core-6.0.2.jar
      • spring-expression-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-04-13

URL: CVE-2023-20863

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20863

Release Date: 2023-04-13

Fix Resolution (org.springframework:spring-expression): 6.0.8

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-resource-server): 3.0.8

Step up your Open Source Security Game with Mend here

CVE-2023-34035

Vulnerable Library - spring-security-config-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.2/spring-security-config-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-oauth2-resource-server-3.0.7.jar (Root Library)
    • spring-security-config-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

  • Spring MVC is on the classpath
  • Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
  • The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints

An application is not vulnerable if any of the following is true:

  • The application does not have Spring MVC on the classpath
  • The application secures no servlets other than Spring MVC’s DispatcherServlet
  • The application uses requestMatchers(String) only for Spring MVC endpoints

Publish Date: 2023-07-18

URL: CVE-2023-34035

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4vpr-xfrp-cj64

Release Date: 2023-07-18

Fix Resolution (org.springframework.security:spring-security-config): 6.0.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-resource-server): 3.0.9

Step up your Open Source Security Game with Mend here

spring-cloud-starter-4.0.3.jar: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter version) Remediation Possible**
CVE-2023-33201 Medium 5.3 bcprov-jdk15on-1.69.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-33201

Vulnerable Library - bcprov-jdk15on-1.69.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

Library home page: https://www.bouncycastle.org/java.html

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.69/bcprov-jdk15on-1.69.jar

Dependency Hierarchy:

  • spring-cloud-starter-4.0.3.jar (Root Library)
    • spring-security-rsa-1.0.11.RELEASE.jar
      • bcpkix-jdk15on-1.69.jar
        • bcprov-jdk15on-1.69.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Publish Date: 2023-07-05

URL: CVE-2023-33201

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-07-05

Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74

Step up your Open Source Security Game with Mend here

spring-boot-starter-data-elasticsearch-3.0.7.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-data-elasticsearch-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/parsson/parsson/1.0.0/parsson-1.0.0.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-data-elasticsearch version) Remediation Possible**
CVE-2023-4043 High 7.5 parsson-1.0.0.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-4043

Vulnerable Library - parsson-1.0.0.jar

Jakarta JSON Processing provider

Library home page: https://github.com/eclipse-ee4j/parsson

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/parsson/parsson/1.0.0/parsson-1.0.0.jar

Dependency Hierarchy:

  • spring-boot-starter-data-elasticsearch-3.0.7.jar (Root Library)
    • spring-data-elasticsearch-5.0.4.jar
      • elasticsearch-java-8.5.3.jar
        • parsson-1.0.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Publish Date: 2023-11-03

URL: CVE-2023-4043

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13

Release Date: 2023-11-03

Fix Resolution: org.eclipse.parsson:parsson:1.0.5,1.1.4;org.eclipse.parsson/jakarta.json:1.0.5,1.1.4

Step up your Open Source Security Game with Mend here

spring-cloud-starter-stream-kafka-4.0.3.jar: 6 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - spring-cloud-starter-stream-kafka-4.0.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/kafka/spring-kafka/3.0.7/spring-kafka-3.0.7.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter-stream-kafka version) Remediation Possible**
CVE-2023-34040 High 7.8 spring-kafka-3.0.7.jar Transitive 4.0.5
CVE-2023-43642 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34455 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34454 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-34453 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A*
CVE-2023-25194 Medium 6.6 kafka-clients-3.3.2.jar Transitive 4.1.0

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34040

Vulnerable Library - spring-kafka-3.0.7.jar

Spring Kafka Support

Library home page: https://github.com/spring-projects/spring-kafka

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/kafka/spring-kafka/3.0.7/spring-kafka-3.0.7.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

Specifically, an application is vulnerable when all of the following are true:

  • The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record
  • The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.
  • The user allows untrusted sources to publish to a Kafka topic

By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.

Publish Date: 2023-08-24

URL: CVE-2023-34040

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34040

Release Date: 2023-08-24

Fix Resolution (org.springframework.kafka:spring-kafka): 3.0.10

Direct dependency fix Resolution (org.springframework.cloud:spring-cloud-starter-stream-kafka): 4.0.5

Step up your Open Source Security Game with Mend here

CVE-2023-43642

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar
        • kafka-clients-3.3.2.jar
          • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit 9f8c3cf74 which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Publish Date: 2023-09-25

URL: CVE-2023-43642

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-55g7-9cwv-5qfv

Release Date: 2023-09-25

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.4

Step up your Open Source Security Game with Mend here

CVE-2023-34455

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar
        • kafka-clients-3.3.2.jar
          • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1.

The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk.

In the case that the compressed variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the chunkSize variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a java.lang.NegativeArraySizeException exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal java.lang.OutOfMemoryError error.

Version 1.1.10.1 contains a patch for this issue.

Publish Date: 2023-06-15

URL: CVE-2023-34455

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qcwq-55hx-v3vh

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2023-34454

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar
        • kafka-clients-3.3.2.jar
          • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.

The function compress(char[] input) in the file Snappy.java receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.

Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.

Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a java.lang.NegativeArraySizeException exception will be raised while trying to allocate the array buf. On the other side, if the result is positive, the buf array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.

The same issue exists also when using the compress functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

Version 1.1.10.1 contains a patch for this issue.

Publish Date: 2023-06-15

URL: CVE-2023-34454

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fjpj-2g6w-x25r

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2023-34453

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.1.8.4/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar
        • kafka-clients-3.3.2.jar
          • snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.

The function shuffle(int[] input) in the file BitShuffle.java receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a java.lang.NegativeArraySizeException exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as java.lang.ArrayIndexOutOfBoundsException.

The same issue exists also when using the shuffle functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.

Version 1.1.10.1 contains a patch for this vulnerability.

Publish Date: 2023-06-15

URL: CVE-2023-34453

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pqr6-cmr2-h8hf

Release Date: 2023-06-15

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.1

Step up your Open Source Security Game with Mend here

CVE-2023-25194

Vulnerable Library - kafka-clients-3.3.2.jar

Library home page: https://kafka.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/kafka/kafka-clients/3.3.2/kafka-clients-3.3.2.jar

Dependency Hierarchy:

  • spring-cloud-starter-stream-kafka-4.0.3.jar (Root Library)
    • spring-cloud-stream-binder-kafka-4.0.3.jar
      • spring-kafka-3.0.7.jar
        • kafka-clients-3.3.2.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A possible security vulnerability has been identified in Apache Kafka Connect API.This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS configand a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the sasl.jaas.configproperty for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via theproducer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties.This will allow the server to connect to the attacker's LDAP serverand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-boxconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connectorclient override policy that permits them.Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usagein SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connectorclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

Publish Date: 2023-02-07

URL: CVE-2023-25194

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://kafka.apache.org/cve-list

Release Date: 2023-02-07

Fix Resolution (org.apache.kafka:kafka-clients): 3.4.0

Direct dependency fix Resolution (org.springframework.cloud:spring-cloud-starter-stream-kafka): 4.1.0

Step up your Open Source Security Game with Mend here

liquibase-core-4.20.0.jar: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - liquibase-core-4.20.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (liquibase-core version) Remediation Possible**
CVE-2022-1471 Critical 9.8 snakeyaml-1.33.jar Transitive 4.21.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-1471

Vulnerable Library - snakeyaml-1.33.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar

Dependency Hierarchy:

  • liquibase-core-4.20.0.jar (Root Library)
    • snakeyaml-1.33.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Publish Date: 2022-12-01

URL: CVE-2022-1471

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374

Release Date: 2022-12-01

Fix Resolution (org.yaml:snakeyaml): 2.0

Direct dependency fix Resolution (org.liquibase:liquibase-core): 4.21.0

Step up your Open Source Security Game with Mend here

spring-boot-starter-security-3.0.7.jar: 1 vulnerabilities (highest severity is: 6.3)

Vulnerable Library - spring-boot-starter-security-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/6.0.2/spring-security-web-6.0.2.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-security version) Remediation Possible**
CVE-2023-20862 Medium 6.3 spring-security-web-6.0.2.jar Transitive 3.0.8

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-20862

Vulnerable Library - spring-security-web-6.0.2.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/6.0.2/spring-security-web-6.0.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.7.jar (Root Library)
    • spring-security-web-6.0.2.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Publish Date: 2023-04-19

URL: CVE-2023-20862

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20862

Release Date: 2023-04-19

Fix Resolution (org.springframework.security:spring-security-web): 6.0.3

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.8

Step up your Open Source Security Game with Mend here

spring-cloud-starter-netflix-eureka-client-4.0.2.jar: 11 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-netflix-eureka-client-4.0.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-cloud-starter-netflix-eureka-client version) Remediation Possible**
CVE-2023-1436 High 7.5 jettison-1.4.0.jar Transitive N/A*
CVE-2022-45693 High 7.5 jettison-1.4.0.jar Transitive N/A*
CVE-2022-45685 High 7.5 jettison-1.4.0.jar Transitive N/A*
CVE-2022-41966 High 7.5 xstream-1.4.19.jar Transitive N/A*
CVE-2022-40152 High 7.5 woodstox-core-6.2.1.jar Transitive N/A*
CVE-2022-40151 High 7.5 xstream-1.4.19.jar Transitive N/A*
CVE-2022-40150 High 7.5 jettison-1.4.0.jar Transitive N/A*
CVE-2022-40149 High 7.5 jettison-1.4.0.jar Transitive N/A*
CVE-2023-2976 High 7.1 guava-19.0.jar Transitive N/A*
CVE-2018-10237 Medium 5.9 guava-19.0.jar Transitive N/A*
CVE-2020-8908 Low 3.3 guava-19.0.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-1436

Vulnerable Library - jettison-1.4.0.jar

A StAX implementation for JSON.

Library home page: https://github.com/jettison-json/jettison

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • jettison-1.4.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Publish Date: 2023-03-22

URL: CVE-2023-1436

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q6g2-g7f3-rr83

Release Date: 2023-03-22

Fix Resolution: org.codehaus.jettison:jettison:1.5.4

Step up your Open Source Security Game with Mend here

CVE-2022-45693

Vulnerable Library - jettison-1.4.0.jar

A StAX implementation for JSON.

Library home page: https://github.com/jettison-json/jettison

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • jettison-1.4.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

Publish Date: 2022-12-13

URL: CVE-2022-45693

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-12-13

Fix Resolution: org.codehaus.jettison:jettison:1.5.2

Step up your Open Source Security Game with Mend here

CVE-2022-45685

Vulnerable Library - jettison-1.4.0.jar

A StAX implementation for JSON.

Library home page: https://github.com/jettison-json/jettison

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • jettison-1.4.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.

Publish Date: 2022-12-13

URL: CVE-2022-45685

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-12-13

Fix Resolution: org.codehaus.jettison:jettison:1.5.2

Step up your Open Source Security Game with Mend here

CVE-2022-41966

Vulnerable Library - xstream-1.4.19.jar

Library home page: http://x-stream.github.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.19/xstream-1.4.19.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • xstream-1.4.19.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

Publish Date: 2022-12-28

URL: CVE-2022-41966

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j563-grx4-pjpv

Release Date: 2022-12-28

Fix Resolution: com.thoughtworks.xstream:xstream:1.4.20

Step up your Open Source Security Game with Mend here

CVE-2022-40152

Vulnerable Library - woodstox-core-6.2.1.jar

Woodstox is a high-performance XML processor that implements Stax (JSR-173), SAX2 and Stax2 APIs

Library home page: https://github.com/FasterXML/woodstox

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/woodstox/woodstox-core/6.2.1/woodstox-core-6.2.1.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-core-2.0.0.jar
      • woodstox-core-6.2.1.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Publish Date: 2022-09-16

URL: CVE-2022-40152

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-16

Fix Resolution: com.fasterxml.woodstox:woodstox-core:5.4.0,6.4.0

Step up your Open Source Security Game with Mend here

CVE-2022-40151

Vulnerable Library - xstream-1.4.19.jar

Library home page: http://x-stream.github.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.19/xstream-1.4.19.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • xstream-1.4.19.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Publish Date: 2022-09-16

URL: CVE-2022-40151

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f8cc-g7j8-xxpm

Release Date: 2022-09-16

Fix Resolution: com.thoughtworks.xstream:xstream:1.4.20

Step up your Open Source Security Game with Mend here

CVE-2022-40150

Vulnerable Library - jettison-1.4.0.jar

A StAX implementation for JSON.

Library home page: https://github.com/jettison-json/jettison

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • jettison-1.4.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

Publish Date: 2022-09-16

URL: CVE-2022-40150

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-16

Fix Resolution: org.codehaus.jettison:jettison:1.5.1

Step up your Open Source Security Game with Mend here

CVE-2022-40149

Vulnerable Library - jettison-1.4.0.jar

A StAX implementation for JSON.

Library home page: https://github.com/jettison-json/jettison

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.4.0/jettison-1.4.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • jettison-1.4.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Publish Date: 2022-09-16

URL: CVE-2022-40149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-16

Fix Resolution: org.codehaus.jettison:jettison:1.5.1

Step up your Open Source Security Game with Mend here

CVE-2023-2976

Vulnerable Library - guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • servo-core-0.12.21.jar
        • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Publish Date: 2023-06-14

URL: CVE-2023-2976

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7g45-4rm6-3mm3

Release Date: 2023-06-14

Fix Resolution: com.google.guava:guava:32.0.1-android,32.0.1-jre

Step up your Open Source Security Game with Mend here

CVE-2018-10237

Vulnerable Library - guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • servo-core-0.12.21.jar
        • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1-jre, 24.1.1-android

Step up your Open Source Security Game with Mend here

CVE-2020-8908

Vulnerable Library - guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-4.0.2.jar (Root Library)
    • eureka-client-2.0.0.jar
      • servo-core-0.12.21.jar
        • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: org.apache.servicemix.bundles:org.apache.servicemix.bundles.guava - 11_1;com.google.guava:guava - 30.0-android

Step up your Open Source Security Game with Mend here

spring-boot-loader-tools-3.0.7.jar: 2 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - spring-boot-loader-tools-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-loader-tools version) Remediation Possible**
CVE-2024-26308 Medium 5.5 commons-compress-1.21.jar Transitive N/A*
CVE-2024-25710 Medium 5.5 commons-compress-1.21.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-26308

Vulnerable Library - commons-compress-1.21.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: https://commons.apache.org/proper/commons-compress/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Dependency Hierarchy:

  • spring-boot-loader-tools-3.0.7.jar (Root Library)
    • commons-compress-1.21.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

Publish Date: 2024-02-19

URL: CVE-2024-26308

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26308

Release Date: 2024-02-19

Fix Resolution: org.apache.commons:commons-compress:1.26.0

Step up your Open Source Security Game with Mend here

CVE-2024-25710

Vulnerable Library - commons-compress-1.21.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4, Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.

Library home page: https://commons.apache.org/proper/commons-compress/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar

Dependency Hierarchy:

  • spring-boot-loader-tools-3.0.7.jar (Root Library)
    • commons-compress-1.21.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Publish Date: 2024-02-19

URL: CVE-2024-25710

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-25710

Release Date: 2024-02-19

Fix Resolution: org.apache.commons:commons-compress:1.26.0

Step up your Open Source Security Game with Mend here

spring-boot-starter-thymeleaf-3.0.7.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-thymeleaf-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.1.1.RELEASE/thymeleaf-3.1.1.RELEASE.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-thymeleaf version) Remediation Possible**
CVE-2023-38286 High 7.5 thymeleaf-3.1.1.RELEASE.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-38286

Vulnerable Library - thymeleaf-3.1.1.RELEASE.jar

Library home page: http://www.thymeleaf.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.1.1.RELEASE/thymeleaf-3.1.1.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-thymeleaf-3.0.7.jar (Root Library)
    • thymeleaf-spring6-3.1.1.RELEASE.jar
      • thymeleaf-3.1.1.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Publish Date: 2023-07-14

URL: CVE-2023-38286

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7gj7-224w-vpr3

Release Date: 2023-07-14

Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE

Step up your Open Source Security Game with Mend here

spring-boot-devtools-3.0.7.jar: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - spring-boot-devtools-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot/3.0.7/spring-boot-3.0.7.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-devtools version) Remediation Possible**
CVE-2023-34055 Medium 6.5 spring-boot-3.0.7.jar Transitive 3.0.13

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34055

Vulnerable Library - spring-boot-3.0.7.jar

Spring Boot

Library home page: https://spring.io/projects/spring-boot

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot/3.0.7/spring-boot-3.0.7.jar

Dependency Hierarchy:

  • spring-boot-devtools-3.0.7.jar (Root Library)
    • spring-boot-3.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  • the application uses Spring MVC or Spring WebFlux
  • org.springframework.boot:spring-boot-actuator is on the classpath

Publish Date: 2023-11-28

URL: CVE-2023-34055

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34055

Release Date: 2023-11-28

Fix Resolution (org.springframework.boot:spring-boot): 3.0.13

Direct dependency fix Resolution (org.springframework.boot:spring-boot-devtools): 3.0.13

Step up your Open Source Security Game with Mend here

spring-boot-starter-logging-3.0.7.jar: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-logging-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.4.7/logback-classic-1.4.7.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-logging version) Remediation Possible**
CVE-2023-6481 High 7.5 logback-core-1.4.7.jar Transitive N/A*
CVE-2023-6378 High 7.5 logback-classic-1.4.7.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-6481

Vulnerable Library - logback-core-1.4.7.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.4.7/logback-core-1.4.7.jar

Dependency Hierarchy:

  • spring-boot-starter-logging-3.0.7.jar (Root Library)
    • logback-classic-1.4.7.jar
      • logback-core-1.4.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution: ch.qos.logback:logback-core:1.2.13,1.3.14,1.4.14

Step up your Open Source Security Game with Mend here

CVE-2023-6378

Vulnerable Library - logback-classic-1.4.7.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.4.7/logback-classic-1.4.7.jar

Dependency Hierarchy:

  • spring-boot-starter-logging-3.0.7.jar (Root Library)
    • logback-classic-1.4.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: ch.qos.logback:logback-classic:1.3.12,1.4.12

Step up your Open Source Security Game with Mend here

spring-boot-starter-web-3.0.7.jar: 3 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - spring-boot-starter-web-3.0.7.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-web version) Remediation Possible**
CVE-2024-22259 High 8.1 spring-web-6.0.7.jar Transitive 3.2.4
CVE-2024-22243 High 8.1 spring-web-6.0.7.jar Transitive 3.1.9
CVE-2023-34053 High 7.5 spring-web-6.0.7.jar Transitive 3.0.13

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-22259

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-web-3.0.7.jar (Root Library)
    • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Publish Date: 2024-03-16

URL: CVE-2024-22259

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22259

Release Date: 2024-01-08

Fix Resolution (org.springframework:spring-web): 6.1.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.2.4

Step up your Open Source Security Game with Mend here

CVE-2024-22243

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-web-3.0.7.jar (Root Library)
    • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

Publish Date: 2024-02-23

URL: CVE-2024-22243

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22243

Release Date: 2024-02-23

Fix Resolution (org.springframework:spring-web): 6.0.17

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.1.9

Step up your Open Source Security Game with Mend here

CVE-2023-34053

Vulnerable Library - spring-web-6.0.7.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/6.0.7/spring-web-6.0.7.jar

Dependency Hierarchy:

  • spring-boot-starter-web-3.0.7.jar (Root Library)
    • spring-web-6.0.7.jar (Vulnerable Library)

Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3

Found in base branch: main

Vulnerability Details

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  • the application uses Spring MVC or Spring WebFlux
  • io.micrometer:micrometer-core is on the classpath
  • an ObservationRegistry is configured in the application to record observations

Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.

Publish Date: 2023-11-28

URL: CVE-2023-34053

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34053

Release Date: 2023-11-28

Fix Resolution (org.springframework:spring-web): 6.0.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.13

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.