camunda-bpm-camel-spring-0.5.jar: 5 vulnerabilities (highest severity is: 9.8) #6
Labels
security vulnerability
Security vulnerability detected by Mend
Comments
mend-bolt-for-github
bot
added
the
security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/4.3.10.RELEASE/spring-beans-4.3.10.RELEASE.jar
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
Vulnerable Library - spring-beans-4.3.10.RELEASE.jar
Spring Beans
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/4.3.10.RELEASE/spring-beans-4.3.10.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Found in base branch: master
Vulnerability Details
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Publish Date: 2022-04-01
URL: CVE-2022-22965
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
Release Date: 2022-04-01
Fix Resolution: org.springframework:spring-beans:5.2.20.RELEASE,5.3.18
Step up your Open Source Security Game with Mend here
Vulnerable Library - mybatis-3.2.8.jar
The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object relational mapping tools.
Library home page: http://www.mybatis.org/core/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/mybatis/mybatis/3.2.8/mybatis-3.2.8.jar
Dependency Hierarchy:
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Found in base branch: master
Vulnerability Details
MyBatis before 3.5.6 mishandles deserialization of object streams.
Publish Date: 2020-10-10
URL: CVE-2020-26945
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-10-26
Fix Resolution: org.mybatis:mybatis:3.5.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - commons-email-1.2.jar
Commons-Email aims to provide an API for sending email. It is built on top of the JavaMail API, which it aims to simplify.
Library home page: http://commons.apache.org/email/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-email/1.2/commons-email-1.2.jar
Dependency Hierarchy:
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Found in base branch: master
Vulnerability Details
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
Publish Date: 2017-08-07
URL: CVE-2017-9801
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9801
Release Date: 2017-08-07
Fix Resolution (org.apache.commons:commons-email): 1.5
Direct dependency fix Resolution (org.camunda.bpm.extension.camel:camunda-bpm-camel-spring): 0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - commons-email-1.2.jar
Commons-Email aims to provide an API for sending email. It is built on top of the JavaMail API, which it aims to simplify.
Library home page: http://commons.apache.org/email/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-email/1.2/commons-email-1.2.jar
Dependency Hierarchy:
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Found in base branch: master
Vulnerability Details
If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).
Publish Date: 2018-03-20
URL: CVE-2018-1294
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-v7cm-w955-pj6g
Release Date: 2018-03-20
Fix Resolution: org.apache.commons:commons-email:1.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-beans-4.3.10.RELEASE.jar
Spring Beans
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/4.3.10.RELEASE/spring-beans-4.3.10.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 359b5d85c318e9f0aa116ed84be44dc8ad415e1d
Found in base branch: master
Vulnerability Details
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
Publish Date: 2022-05-12
URL: CVE-2022-22970
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22970
Release Date: 2022-05-12
Fix Resolution: org.springframework:spring-beans:5.2.22,5.3.20;org.springframework:spring-core:5.2.22,5.3.20
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: