Vulnerabilities

 9 via 18 paths

Dependencies

 116

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 9
  • 1
Severity
  • 1
  • 8
  • 1
Status
  • 10
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: commons-lang:commons-lang
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.netflix.hystrix:hystrix-core@1.5.18 › com.netflix.archaius:archaius-core@0.4.1 › commons-configuration:commons-configuration@1.8 › commons-lang:commons-lang@2.6

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

Uncontrolled Recursion vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: commons-configuration:commons-configuration
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.netflix.hystrix:hystrix-core@1.5.18 › com.netflix.archaius:archaius-core@0.4.1 › commons-configuration:commons-configuration@1.8

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due several issues in the loading of untrusted configurations. An attacker can cause excessive resource consumption by manipulating the configuration data or introducing unexpected usage patterns. Users affected by this issue are recommended to upgrade to the 2.x version line org.apache.commons:commons-configuration2, which fixes these issues.

Note: This is only exploitable if the application is configured to load untrusted configurations.

Remediation

There is no fixed version for commons-configuration:commons-configuration.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity
new

Improper Neutralization

  • Vulnerable module: net.minidev:json-smart
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0

Overview

net.minidev:json-smart is a Java JSON parser.

Affected versions of this package are vulnerable to Improper Neutralization via the parseInner function in the JSONParserBase parser. An attacker can evade JSONValue.parseStrict or isValidJsonStrict by sending a valid JSON value followed by a literal 0x1A character and malformed content; parseInner mistakes the character for end-of-input and skips the trailing-data check. Applications that rely on these strict-validation methods can accept input that downstream parsers such as Jackson or Gson interpret differently.

Remediation

There is no fixed version for net.minidev:json-smart.

References

Improper Neutralization vulnerability report

medium severity
new

Inefficient Algorithmic Complexity

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with ClassWriter.COMPUTE_FRAMES; their methods make frame computation’s fixpoint algorithm converge slowly.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Inefficient Algorithmic Complexity vulnerability report

medium severity
new

Inefficient Algorithmic Complexity

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames() and computeMaxStackAndLocal() methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTE_FRAMES or COMPUTE_MAXS, it allocates excessive Edge objects, causing an OutOfMemoryError that crashes the JVM.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Inefficient Algorithmic Complexity vulnerability report

medium severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via readBootstrapMethodsAttribute() in ClassReader. When an application parses an attacker-supplied class file, a crafted BootstrapMethods attribute with an unchecked declared length can trigger an allocation of roughly 2 GB from a file of about 100 bytes, causing an OutOfMemoryError that crashes the JVM or the thread processing the class.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors() method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM processes the subroutine.

Notes

  • The attacker must get a user to load or process the crafted class file.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity
new

Uncontrolled Recursion

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.jayway.jsonpath:json-path@2.10.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the parseType method in SignatureReader. An attacker can trigger a StackOverflowError and disrupt class transformation by supplying a crafted class file with a Signature attribute containing deeply nested generic type arguments.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Uncontrolled Recursion vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: no.cantara.base:Hystrix-BaseCommands@0.1.104 and org.glassfish.jersey.media:jersey-media-json-binding@2.48

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › org.eclipse:yasson@1.0.11 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.sonatype.plexus:plexus-sec-dispatcher@1.4 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.apache.maven:maven-project@2.2.1 › org.codehaus.plexus:plexus-container-default@1.0-alpha-9-stable-1 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.sonatype.plexus:plexus-sec-dispatcher@1.4 › org.sonatype.plexus:plexus-cipher@1.4 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.apache.maven:maven-project@2.2.1 › org.apache.maven:maven-artifact-manager@2.2.1 › org.codehaus.plexus:plexus-container-default@1.0-alpha-9-stable-1 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.apache.maven:maven-project@2.2.1 › org.apache.maven:maven-plugin-registry@2.2.1 › org.codehaus.plexus:plexus-container-default@1.0-alpha-9-stable-1 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.apache.maven:maven-project@2.2.1 › org.apache.maven:maven-profile@2.2.1 › org.codehaus.plexus:plexus-container-default@1.0-alpha-9-stable-1 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › no.cantara.base:Hystrix-BaseCommands@0.1.104 › com.github.kevinsawicki:http-request2@6.0.5 › org.apache.maven.plugins:maven-gpg-plugin@1.6 › org.apache.maven:maven-project@2.2.1 › org.apache.maven:maven-settings@2.2.1 › org.codehaus.plexus:plexus-container-default@1.0-alpha-9-stable-1 › junit:junit@4.13.2

EPL-1.0 license

EPL-1.0 license vulnerability report

low severity

Information Exposure

  • Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
  • Introduced through: com.slack.api:slack-api-client@1.53.0

Detailed paths

  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › com.slack.api:slack-api-client@1.53.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › com.slack.api:slack-api-client@1.53.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › com.slack.api:slack-api-client@1.53.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
  • Introduced through: Cantara/Whydah-StatisticsDashboard@Cantara/Whydah-StatisticsDashboard › com.slack.api:slack-api-client@1.53.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.

Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

PoC by JLLeitschuh

package org.jlleitschuh.sandbox

import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files

class KotlinTempDirectoryPermissionCheck {
    @Test
    fun `kotlin check default directory permissions`() {
        val dir = createTempDir()
        runLS(dir.parentFile, dir) // Prints drwxr-xr-x
    }

    @Test
    fun `Files check default directory permissions`() {
        val dir = Files.createTempDirectory("random-directory")
        runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
    }

    @Test
    fun `kotlin check default file permissions`() {
        val file = createTempFile()
        runLS(file.parentFile, file) // Prints -rw-r--r--
    }

    @Test
    fun `Files check default file permissions`() {
        val file = Files.createTempFile("random-file", ".txt")
        runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
    }

    private fun runLS(file: File, lookingFor: File) {
        val processBuilder = ProcessBuilder()
        processBuilder.command("ls", "-l", file.absolutePath)
        try {
            val process = processBuilder.start()
            val output = StringBuilder()
            val reader = BufferedReader(
                InputStreamReader(process.inputStream)
            )
            reader.lines().forEach { line ->
                if (line.contains("total")) {
                    output.append(line).append('\n')
                }
                if (line.contains(lookingFor.name)) {
                    output.append(line).append('\n')
                }
            }
            val exitVal = process.waitFor()
            if (exitVal == 0) {
                println("Success!")
                println(output)
            } else {
                //abnormal...
            }
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: InterruptedException) {
            e.printStackTrace()
        }
    }
}

Remediation

Upgrade org.jetbrains.kotlin:kotlin-stdlib to version 2.1.0 or higher.

References

Information Exposure vulnerability report