test

[attiasas]

• All tests passed. If this feature is not already covered by the tests, I added new tests.

---

[attiasas]

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY	CONTEXTUAL ANALYSIS	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS	CVES
Medium	Applicable	org.jfrog.buildinfo:build-info-extractor:2.41.x-SNAPSHOT com.fasterxml.jackson.core:jackson-databind:2.15.2 org.mock-server:mockserver-netty:5.15.0 org.jfrog.buildinfo:build-info-extractor-docker:2.41.x-SNAPSHOT com.github.docker-java:docker-java:3.3.3 com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.15.2	com.fasterxml.jackson.core:jackson-databind:2.15.2	-	CVE-2023-35116

---

🐸 JFrog Frogbot

[attiasas]

mapper.writeValueAsString(this)

at build-info-client/src/main/java/org/jfrog/build/client/artifactoryXrayResponse/ArtifactoryXrayResponse.java (line 60)

📦🔍 Contextual Analysis CVE Vulnerability

Severity	Impacted Dependency	Finding	CVE
Medium	com.fasterxml.jackson.core:jackson-databind:2.15.2	At least one of the vulnerable functions writeValueAsString, writeValueAsBytes, writeValue, serializeValue is called with external input	CVE-2023-35116

Description

The scanner checks for calls to the vulnerable functions with external input:

• ObjectMapper.writeValue()
• ObjectMapper.writeValueAsString()
• ObjectMapper.writeValueAsBytes()
• ObjectWriter.writeValue()
• ObjectWriter.writeValueAsString()
• ObjectWriter.writeValueAsBytes()
• ser.DefaultSerializerProvider.serializeValue()

For determining the applicability of this CVE, an additional condition (that the scanner currently does not check) should be verified: The input argument to those functions is a cyclic object (e.g. a HashMap object with a reference to itself).

CVE details

An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

---

🐸 JFrog Frogbot