Giter Club home page Giter Club logo

example-bi-directional-consumer-wiremock's Introduction

Example Java Consumer - Wiremock (BYO Adapter)

Build

Can I deploy Status

Overview of Example

This is an example of a Java "Product" API consumer that uses Wiremock, Pact, PactFlow and GitHub Actions to generate and publish Pact consumer contracts.

It performs pre-deployment cross-compatibility checks to ensure that it is compatible with specified providers using the Bi-Directional contract capability of PactFlow.

See the full PactFlow Bi-Directional Workshop for which this can be substituted in as the "consumer".

Overview of Part of Bi-Directional Contract Testing Flow

In the following diagram, You can see how the consumer testing process works - it's the same as the current Pact process.

When we call "can-i-deploy" the cross-contract validation process kicks off on PactFlow, to ensure any consumer consumes a valid subset of the OAS for the provider.

Consumer Test

The project uses a Makefile to simulate a very simple build pipeline with two stages - test and deploy.

When you run the CI pipeline (see below for doing this), the pipeline should perform the following activities (simplified):

  • Test
    • Run tests (including the pact tests that generate the contract)
    • Publish pacts, tagging the consumer version with the name of the current branch
    • Check if we are safe to deploy to Production with can-i-deploy (ie. has the cross-contract validation has been successfully performed)
  • Deploy (only from master)
    • Deploy app to Production
    • Record the Production deployment in the Pact Broker

Consumer Pipeline

Compatibile with Providers

This project is currently compatible with the following provider(s):

See Environment variables on how to set these up.

Pre-requisites

Software:

Environment variables

To be able to run some of the commands locally, you will need to export the following environment variables into your shell:

Set PACT_PROVIDER to one of the following

NOTE:- It defaults to pactflow-example-bi-directional-provider-restassured for compatibility with the Java RestAssured provider

Usage

Steps

  • make test - run the tests locally
  • make fake_ci - run the CI process, but locally

OS/Platform specific considerations

The makefile is configured to run on Unix based systems such as you would find in most common CI/CD pipelines.

They can be run locally on Unix/Mac, or on Windows via WSL2.

Windows

You can still try this example locally on Windows using powershell and running commands manually.

Click to see windows specific instructions here

These will be the same commands that are used in the makefile with a few manual tweaks.

  1. Make sure you have set all of the environment variables, in powershell they can be set like so.

     $env:GIT_BRANCH="main"
    
  2. Publish the pact that was generated. The step uses the pact-cli docker image to publish the pact to your pactflow account. The path for <path_to_project_root> needs to be converted from Windows paths to UNIX ones as the Docker container is using UNIX. Either hard code this or set it as another environment variable.

    C:\Users\Person\Documents\example-bi-directional-consumer-dotnet

    becomes

    /c/Users/Candy/Documents/PactFlow/example-bi-directional-consumer-dotnet

    $env:VARIABLE_NAME refers to the environment variables in windows.

    docker run --rm -v <path_to_project_root>:<path_to_project_root> -e PACT_BROKER_BASE_URL -e PACT_BROKER_TOKEN pactfoundation/pact-cli publish <path_to_pacts_folder> --consumer-app-version $env:GIT_COMMIT --branch $env:GIT_BRANCH
    
    
  3. Check can-i-deploy to see if your provider is compatible with your pact.

    docker run --rm -v <path_to_project_root>:<path_to_project_root> -e PACT_BROKER_BASE_URL -e PACT_BROKER_TOKEN pactfoundation/pact-cli  broker can-i-deploy --pacticipant pactflow-example-bi-directional-consumer-dotnet --version $env:GIT_COMMIT --to-environment production  --retry-while-unknown 0 --retry-interval 10
    
  4. Have a look at what other commands are available in the Makefile. All of them can be ran locally from Powershell by changing the windows paths to UNIX and replacing the environment variable references. Any variable referenced as ${VARIABLE} can be changed to $env:VARIABLE to reference environment variables in Powershell.

Caveats

Related topics / posts / discussions

Other examples of how to do this form of testing

  • TBC

Found an issue?

Reach out via a GitHub Issue, or reach us over in the Pact foundation Slack

example-bi-directional-consumer-wiremock's People

Contributors

inksprout avatar mefellows avatar mend-for-github-com[bot] avatar you54f avatar

Stargazers

 avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

example-bi-directional-consumer-wiremock's Issues

CVE-2020-9484 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2020-9484 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Publish Date: 2020-05-20

URL: CVE-2020-9484

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484

Release Date: 2020-05-20

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.35

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.8.RELEASE


  • Check this box to open an automated fix PR

CVE-2020-13934 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2020-13934 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13934

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.37

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.9.RELEASE


  • Check this box to open an automated fix PR

CVE-2016-1000027 (High) detected in spring-web-5.2.4.RELEASE.jar

CVE-2016-1000027 - High Severity Vulnerability

Vulnerable Library - spring-web-5.2.4.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.4.RELEASE/69936c9f180a89ecaa0f750cf2121c6f728eec2c/spring-web-5.2.4.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-web-5.2.4.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-02

Fix Resolution (org.springframework:spring-web): 5.3.0

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.4.0


  • Check this box to open an automated fix PR

CVE-2021-43980 (High) detected in tomcat-embed-core-9.0.31.jar - autoclosed

CVE-2021-43980 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Publish Date: 2022-09-28

URL: CVE-2021-43980

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3

Release Date: 2022-09-28

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.62

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.5.13


  • Check this box to open an automated fix PR

CVE-2022-42004 (High) detected in jackson-databind-2.10.2.jar

CVE-2022-42004 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-json-2.2.5.RELEASE.jar
      • jackson-databind-2.10.2.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: 2022-10-02

URL: CVE-2022-42004

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-02

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.13.4

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9


  • Check this box to open an automated fix PR

CVE-2021-22118 (High) detected in spring-web-5.2.4.RELEASE.jar

CVE-2021-22118 - High Severity Vulnerability

Vulnerable Library - spring-web-5.2.4.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.4.RELEASE/69936c9f180a89ecaa0f750cf2121c6f728eec2c/spring-web-5.2.4.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-web-5.2.4.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Publish Date: 2021-05-27

URL: CVE-2021-22118

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2021-22118

Release Date: 2021-05-27

Fix Resolution (org.springframework:spring-web): 5.2.15.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.11.RELEASE


  • Check this box to open an automated fix PR

CVE-2020-36518 (High) detected in jackson-databind-2.10.2.jar

CVE-2020-36518 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-json-2.2.5.RELEASE.jar
      • jackson-databind-2.10.2.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.

Publish Date: 2022-03-11

URL: CVE-2020-36518

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-11

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6.1

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.0


  • Check this box to open an automated fix PR

CVE-2022-27772 (High) detected in spring-boot-2.2.5.RELEASE.jar

CVE-2022-27772 - High Severity Vulnerability

Vulnerable Library - spring-boot-2.2.5.RELEASE.jar

Spring Boot

Library home page: https://projects.spring.io/spring-boot/#/spring-boot-parent/spring-boot

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/2.2.5.RELEASE/3cfc7b002e7c47f96298df953142719a67863998/spring-boot-2.2.5.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-2.2.5.RELEASE.jar
      • spring-boot-2.2.5.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.

Publish Date: 2022-03-30

URL: CVE-2022-27772

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cm59-pr5q-cw85

Release Date: 2022-03-30

Fix Resolution (org.springframework.boot:spring-boot): 2.2.11.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.11.RELEASE


  • Check this box to open an automated fix PR

CVE-2017-18640 (High) detected in snakeyaml-1.25.jar

CVE-2017-18640 - High Severity Vulnerability

Vulnerable Library - snakeyaml-1.25.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.25/8b6e01ef661d8378ae6dd7b511a7f2a33fae1421/snakeyaml-1.25.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-2.2.5.RELEASE.jar
      • snakeyaml-1.25.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Publish Date: 2019-12-12

URL: CVE-2017-18640

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640

Release Date: 2019-12-12

Fix Resolution (org.yaml:snakeyaml): 1.26

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.0.RELEASE


  • Check this box to open an automated fix PR

CVE-2021-25122 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2021-25122 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Publish Date: 2021-03-01

URL: CVE-2021-25122

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.9.RELEASE


  • Check this box to open an automated fix PR

CVE-2022-42003 (High) detected in jackson-databind-2.10.2.jar

CVE-2022-42003 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-json-2.2.5.RELEASE.jar
      • jackson-databind-2.10.2.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1

Publish Date: 2022-10-02

URL: CVE-2022-42003

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-02

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.13.0-rc1

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.0


  • Check this box to open an automated fix PR

CVE-2020-13935 (High) detected in tomcat-embed-websocket-9.0.31.jar

CVE-2020-13935 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-websocket-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-websocket/9.0.31/b6d6013a37e76c2faada9fc8b8c0be6694de5c71/tomcat-embed-websocket-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-websocket-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Publish Date: 2020-07-14

URL: CVE-2020-13935

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2020-07-14

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-websocket): 9.0.37

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.9.RELEASE


  • Check this box to open an automated fix PR

CVE-2022-25857 (High) detected in snakeyaml-1.25.jar

CVE-2022-25857 - High Severity Vulnerability

Vulnerable Library - snakeyaml-1.25.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.25/8b6e01ef661d8378ae6dd7b511a7f2a33fae1421/snakeyaml-1.25.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-2.2.5.RELEASE.jar
      • snakeyaml-1.25.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Publish Date: 2022-08-30

URL: CVE-2022-25857

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857

Release Date: 2022-08-30

Fix Resolution (org.yaml:snakeyaml): 1.31

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.6.9


  • Check this box to open an automated fix PR

CVE-2022-22965 (High) detected in spring-beans-5.2.4.RELEASE.jar

CVE-2022-22965 - High Severity Vulnerability

Vulnerable Library - spring-beans-5.2.4.RELEASE.jar

Spring Beans

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-beans/5.2.4.RELEASE/fc5b50a647f319f9ca6ab272177f6d8188bfdfe5/spring-beans-5.2.4.RELEASE.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-web-5.2.4.RELEASE.jar
      • spring-beans-5.2.4.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Publish Date: 2022-04-01

URL: CVE-2022-22965

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Release Date: 2022-04-01

Fix Resolution (org.springframework:spring-beans): 5.2.20.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.4.0


  • Check this box to open an automated fix PR

CVE-2020-11996 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2020-11996 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Publish Date: 2020-06-26

URL: CVE-2020-11996

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E,http://tomcat.apache.org/security-10.html

Release Date: 2020-06-26

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.36

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.8.RELEASE


  • Check this box to open an automated fix PR

CVE-2021-41079 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2021-41079 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Publish Date: 2021-09-16

URL: CVE-2021-41079

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-10.html

Release Date: 2021-09-16

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.44

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.10.RELEASE


  • Check this box to open an automated fix PR

CVE-2021-25329 (High) detected in tomcat-embed-core-9.0.31.jar

CVE-2021-25329 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-9.0.31.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.31/1e2adb1ea4f2464062ded86b095adf11dc488877/tomcat-embed-core-9.0.31.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.2.5.RELEASE.jar
      • tomcat-embed-core-9.0.31.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Publish Date: 2021-03-01

URL: CVE-2021-25329

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Release Date: 2021-03-01

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.9.RELEASE


  • Check this box to open an automated fix PR

CVE-2020-25649 (High) detected in jackson-databind-2.10.2.jar

CVE-2020-25649 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.2.5.RELEASE.jar (Root Library)
    • spring-boot-starter-json-2.2.5.RELEASE.jar
      • jackson-databind-2.10.2.jar (Vulnerable Library)

Found in HEAD commit: db1210550e283da70ff46b65309a89709f71e7a1

Found in base branch: master

Vulnerability Details

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Publish Date: 2020-12-03

URL: CVE-2020-25649

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-03

Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.10.5.1

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.3.0.RELEASE


  • Check this box to open an automated fix PR

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.