Vulnerabilities

 11 via 17 paths

Dependencies

 65

Source

 GitHub

Commit

 a51bf325

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 11
  • 3
Severity
  • 5
  • 8
  • 1
Status
  • 14
  • 0
  • 0

high severity

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • Vulnerable module: commons-beanutils:commons-beanutils
  • Introduced through: commons-beanutils:commons-beanutils@1.9.4

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › commons-beanutils:commons-beanutils@1.9.4
    Remediation: Upgrade to commons-beanutils:commons-beanutils@1.11.0.

Overview

commons-beanutils:commons-beanutils is a provides an easy-to-use but flexible wrapper around reflection and introspection.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via the getProperty and getNestedProperty methods of the PropertyUtilsBean class. An attacker can execute arbitrary code by accessing the declaredClass property of Java enum objects, which allows access to the ClassLoader.

Note:

The BeanIntrospector class that can mitigate this vulnerability was added in version 1.9.2 but its usage was not enabled by default.

Remediation

Upgrade commons-beanutils:commons-beanutils to version 1.11.0 or higher.

References

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability report

high severity

Infinite loop

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.3.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Infinite loop due to the improper handling of certain inputs during the parsing of dump files. An attacker can cause the application to enter an infinite loop by supplying crafted inputs.

Remediation

Upgrade org.apache.commons:commons-compress to version 1.26.0 or higher.

References

Infinite loop vulnerability report

high severity

Arbitrary Code Execution

  • Vulnerable module: org.apache.commons:commons-text
  • Introduced through: org.apache.commons:commons-text@1.8

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.commons:commons-text@1.8
    Remediation: Upgrade to org.apache.commons:commons-text@1.10.0.

Overview

Affected versions of this package are vulnerable to Arbitrary Code Execution via the StringSubstitutor interpolator object. Exploiting this vulnerability is possible when untrusted data flows into the StringSubstitutor.replace() or StringSubstitutor.replaceIn() methods.

Due to the nature of these methods as ones that process application data and not user input, a remote attacker would need prior access to a system in the affected environment positioned to supply such data.

Notes

The Nashorn scripting engine that can be used to exploit this vulnerability was available by default in JDKs up to 14.0.2. As of JDK 15, this vulnerability can only be exploited if another scripting engine has been added, such as JEXL.

Vulnerable lookups:

  1. script - executes expressions using the JVM script execution engine (javax.script)

  2. dns - resolves dns records

  3. url - loads values from urls, including from remote servers

PoC

final StringSubstitutor interpolator = StringSubstitutor.createInterpolator();
String out = interpolator.replace("${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}");
System.out.println(out);

Remediation

Upgrade org.apache.commons:commons-text to version 1.10.0 or higher.

References

Arbitrary Code Execution vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.1.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.poi:poi-scratchpad
  • Introduced through: org.apache.poi:poi-scratchpad@4.1.1

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-scratchpad@4.1.1
    Remediation: Upgrade to org.apache.poi:poi-scratchpad@5.2.1.

Overview

org.apache.poi:poi-scratchpad is a Java API To Access Microsoft Format Files

Affected versions of this package are vulnerable to Denial of Service (DoS) via the parsing of a crafted TNEF file coming from an untrusted source, causing memory exhaustion.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.poi:poi-scratchpad to version 5.2.1 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: commons-io:commons-io
  • Introduced through: commons-io:commons-io@2.11.0

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › commons-io:commons-io@2.11.0
    Remediation: Upgrade to commons-io:commons-io@2.14.0.

Overview

commons-io:commons-io is a The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') through the XmlStreamReader class. An attacker can cause the application to consume excessive CPU resources by sending specially crafted XML content.

Remediation

Upgrade commons-io:commons-io to version 2.14.0 or higher.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: org.apache.poi:poi-ooxml
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.4.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.poi:poi-ooxml is a Java API To Access Microsoft Format Files.

Affected versions of this package are vulnerable to Improper Input Validation due to the parsing process of OOXML format files. An attacker can manipulate the file content by adding zip entries with duplicate names, leading to inconsistent data being read by different products depending on which duplicate entry is selected.

Remediation

Upgrade org.apache.poi:poi-ooxml to version 5.4.0 or higher.

References

Improper Input Validation vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.1.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.1.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.poi:poi-ooxml@4.1.1 and com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to org.apache.poi:poi-ooxml@5.1.0.
  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › org.apache.poi:poi-ooxml@4.1.1 › org.apache.commons:commons-compress@1.19
    Remediation: Upgrade to com.alibaba:easyexcel@3.1.0.

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-classic
  • Introduced through: org.springframework.boot:spring-boot-starter-json@4.1.0-M2

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.springframework.boot:spring-boot-starter-json@4.1.0-M2 › org.springframework.boot:spring-boot-starter@4.1.0-M2 › org.springframework.boot:spring-boot-starter-logging@4.1.0-M2 › ch.qos.logback:logback-classic@1.5.32

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-core
  • Introduced through: org.springframework.boot:spring-boot-starter-json@4.1.0-M2

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › org.springframework.boot:spring-boot-starter-json@4.1.0-M2 › org.springframework.boot:spring-boot-starter@4.1.0-M2 › org.springframework.boot:spring-boot-starter-logging@4.1.0-M2 › ch.qos.logback:logback-classic@1.5.32 › ch.qos.logback:logback-core@1.5.32

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › cglib:cglib@3.3.0 › junit:junit@4.12

EPL-1.0 license

EPL-1.0 license vulnerability report

low severity

Information Exposure

  • Vulnerable module: junit:junit
  • Introduced through: com.alibaba:easyexcel@3.0.5

Detailed paths

  • Introduced through: Ahaochan/ahao-common-utils@Ahaochan/ahao-common-utils#a51bf325c9e97a4f0991f62c69e2baf047df8c85 › com.alibaba:easyexcel@3.0.5 › cglib:cglib@3.3.0 › junit:junit@4.12
    Remediation: Upgrade to com.alibaba:easyexcel@3.0.5.

Overview

junit:junit is an unit testing framework for Java

Affected versions of this package are vulnerable to Information Exposure. The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

Note: This vulnerability does not allow other users to overwrite the contents of these directories or files. This only affects Unix like systems.

Remediation

Upgrade junit:junit to version 4.13.1 or higher.

References

Information Exposure vulnerability report