[Snyk:Medium] Flyway Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')(due on 09/16/2024)

[pkfec]

Overview

Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only exploitable if the application is configured to use multiple threads or processes for handling authentication requests.

Introduced through:

unknown:unknown@0.0.0 › org.flywaydb:flyway-commandline@10.12.0 › com.microsoft.azure:msal4j@1.13.8

Completion criteria:

• upgrade flyway to latest version

[cnlucas]

This was remediated by #5939