Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Apiiro] 3 risks #8

Closed
apiiro-staging bot opened this issue Jul 1, 2024 · 0 comments
Closed

[Apiiro] 3 risks #8

apiiro-staging bot opened this issue Jul 1, 2024 · 0 comments

Comments

@apiiro-staging
Copy link

apiiro-staging bot commented Jul 1, 2024

July 1 agg

Discovered on: Mar 10, 2024 14:21
Dependency: org.springframework:spring-web
Version:
Type: Direct
Introduced through:

  • org.springframework:spring-web: 4.1.6.RELEASE

Vulnerabilities

About this package:

External dependency: org.springframework:spring-web - https://github.com/spring-projects/spring-framework
Package details: Spring Web
Latest version: 6.1.10
License: Apache-2.0
Insights:

  • Backed by foundation - This package is backed by a respected OSS foundation and adheres to its maintenance standards
  • Frequent commits - New code commits are frequently being pushed
  • Has vulnerabilities - One or more vulnerabilities have been reported for this package

Remediation

Upgrade to org.springframework:[email protected]:

  1. Go to common/pom.xml
  2. Replace vulnerable version 4.1.6.RELEASE with fix version 6.0.19
    View in Apiiro

Discovered on: Mar 10, 2024 15:57
Dependency: com.fasterxml.jackson.core:jackson-databind
Version:
Type: Direct
Introduced through:

  • com.fasterxml.jackson.core:jackson-databind: 2.6.5

Vulnerabilities

About this package:

External dependency: com.fasterxml.jackson.core:jackson-databind - https://github.com/FasterXML/jackson
Package details: General data-binding functionality for Jackson: works on core streaming API
Latest version: 2.17.1
License: Apache-2.0
Insights:

  • Frequent commits - New code commits are frequently being pushed
  • Historical CVEs - This package had at least two critical or high CVEs in two consecutive years
  • Has vulnerabilities - One or more vulnerabilities have been reported for this package
  • High EPSS - This package has one vulnerability that is highly likely to be exploited according to the EPSS algorithm
  • Exploit POC - This package has 5 vulnerabilities with proof of concept exploits.

Remediation

Upgrade to com.fasterxml.jackson.core:[email protected]:

  1. Go to api2-model/pom.xml
  2. Replace vulnerable version 2.6.5 with fix version 2.16.0
    View in Apiiro

Discovered on: Mar 10, 2024 15:51
Dependency: org.codehaus.jackson:jackson-mapper-asl
Version: 1.9.13
Type: Sub dependency
Introduced through:

  • org.codehaus.jackson:jackson-xc: 1.9.13 > org.codehaus.jackson:jackson-mapper-asl: 1.9.13

Vulnerabilities

About this package:

External dependency: org.codehaus.jackson:jackson-mapper-asl - http://jackson.codehaus.org
Package details: Data Mapper package is a high-performance data binding package
built on Jackson JSON processor

Latest version: 1.9.13
License: Apache-2.0
Insights:

  • Not fixable - This package includes a CVE that has not been fixed by an official release or patch
  • Current CVE - A CVE on this package has not been fixed by an official release/patch
  • Single maintainer - This package is maintained by a single developer
  • Has vulnerabilities - One or more vulnerabilities have been reported for this package
  • Exploit POC - This package has 1 vulnerabilities with proof of concept exploits.

Remediation

No remediation available.
View in Apiiro

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant