aws-java-sdk-core-1.11.497.jar: 4 vulnerabilities (highest severity is: 7.5) #289
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /SingularityMesosClient/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - ion-java-1.0.2.jar
A Java implementation of the Amazon Ion data notation.
Library home page: https://github.com/amznlabs/ion-java/
Path to dependency file: /SingularityMesosClient/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in
ion-javafor applications that useion-javato deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into theIonValuemodel and then invoke certainIonValuemethods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using theIonValuemodel, results in aStackOverflowErrororiginating from theion-javalibrary. The patch is included inion-java1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.Publish Date: 2024-01-03
URL: CVE-2024-21634
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-264p-99wq-f4j6
Release Date: 2024-01-03
Fix Resolution: com.amazon.ion:ion-java:1.10.5
Vulnerable Library - jackson-dataformat-cbor-2.9.9.jar
Support for reading and writing Concise Binary Object Representation ([CBOR](https://www.rfc-editor.org/info/rfc7049) encoded data using Jackson abstractions (streaming API, data binding, tree model)
Library home page: http://fasterxml.com/
Path to dependency file: /EmbedSingularityExample/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Publish Date: 2021-02-18
URL: CVE-2020-28491
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491
Release Date: 2021-02-18
Fix Resolution (com.fasterxml.jackson.dataformat:jackson-dataformat-cbor): 2.11.4
Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.657
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - commons-codec-1.10.jar
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Library home page: http://www.apache.org/
Path to dependency file: /SingularityBase/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.
Publish Date: 2019-05-20
URL: WS-2019-0379
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2019-05-20
Fix Resolution (commons-codec:commons-codec): 1.13
Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.657
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - httpclient-4.5.5.jar
Apache HttpComponents Client
Library home page: http://www.apache.org/
Path to dependency file: /SingularityS3Base/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Publish Date: 2020-12-02
URL: CVE-2020-13956
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.4%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956
Release Date: 2020-12-02
Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.13
Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.657
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: