You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
the application uses Spring MVC or Spring WebFlux
org.springframework.boot:spring-boot-actuator is on the classpath
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 2 vulnerabilities (highest severity is: 9.8)
jhipster-framework-8.0.0-beta.2.jar: 3 vulnerabilities (highest severity is: 9.8)
Nov 29, 2023
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 3 vulnerabilities (highest severity is: 9.8)
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 9.8)
Nov 30, 2023
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 9.8)
jhipster-framework-8.0.0-beta.2.jar: 5 vulnerabilities (highest severity is: 9.8)
Dec 6, 2023
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 5 vulnerabilities (highest severity is: 9.8)
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 9.8)
Jul 17, 2024
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 9.8)
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 8.3)
Sep 8, 2024
mend-bolt-for-githubbot
changed the title
jhipster-framework-8.0.0-beta.2.jar: 4 vulnerabilities (highest severity is: 8.3)
jhipster-framework-8.0.0-beta.2.jar: 5 vulnerabilities (highest severity is: 8.3)
Oct 20, 2024
Vulnerable Library - jhipster-framework-8.0.0-beta.2.jar
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/6.0.7/spring-context-6.0.7.jar
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-1471
Vulnerable Library - snakeyaml-1.33.jar
YAML 1.1 parser and emitter for Java
Library home page: https://bitbucket.org/snakeyaml/snakeyaml
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Publish Date: 2022-12-01
URL: CVE-2022-1471
CVSS 3 Score Details (8.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
Release Date: 2022-12-01
Fix Resolution (org.yaml:snakeyaml): 2.0
Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.1.0
Step up your Open Source Security Game with Mend here
CVE-2023-6378
Vulnerable Library - logback-classic-1.4.8.jar
logback-classic module
Library home page: http://www.qos.ch
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.4.8/logback-classic-1.4.8.jar
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
Publish Date: 2023-11-29
URL: CVE-2023-6378
CVSS 3 Score Details (7.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://logback.qos.ch/news.html#1.3.12
Release Date: 2023-11-29
Fix Resolution (ch.qos.logback:logback-classic): 1.4.12
Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.2.0
Step up your Open Source Security Game with Mend here
CVE-2023-20863
Vulnerable Library - spring-expression-6.0.7.jar
Spring Expression Language (SpEL)
Library home page: https://spring.io/projects/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/6.0.7/spring-expression-6.0.7.jar
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Publish Date: 2023-04-13
URL: CVE-2023-20863
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-20863
Release Date: 2023-04-13
Fix Resolution (org.springframework:spring-expression): 6.0.8
Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.0.0
Step up your Open Source Security Game with Mend here
CVE-2023-34055
Vulnerable Library - spring-boot-3.1.1.jar
Spring Boot
Library home page: https://spring.io
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot/3.1.1/spring-boot-3.1.1.jar
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
Publish Date: 2023-11-28
URL: CVE-2023-34055
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-34055
Release Date: 2023-11-28
Fix Resolution (org.springframework.boot:spring-boot): 3.1.6
Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.1.0
Step up your Open Source Security Game with Mend here
CVE-2024-38820
Vulnerable Library - spring-context-6.0.7.jar
Spring Context
Library home page: https://spring.io/projects/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/6.0.7/spring-context-6.0.7.jar
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Publish Date: 2024-10-18
URL: CVE-2024-38820
CVSS 3 Score Details (3.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2024-38820
Release Date: 2024-10-18
Fix Resolution (org.springframework:spring-context): 6.1.14
Direct dependency fix Resolution (tech.jhipster:jhipster-framework): 8.3.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: