Vulnerabilities

 7 via 13 paths

Dependencies

 12

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 6
Status
  • 7
  • 0
  • 0

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.jsoup:jsoup
  • Introduced through: org.jsoup:jsoup@1.23.1

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › org.jsoup:jsoup@1.23.1
    Remediation: Upgrade to org.jsoup:jsoup@1.23.2.

Overview

org.jsoup:jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the XmlTreeBuilder namespace scope tracking in src/main/java/org/jsoup/parser/XmlTreeBuilder.java. An attacker can exhaust JVM heap memory and terminate the application by supplying a deeply nested XML document with uniquely named namespace declarations. The parser copies the inherited namespace map on each start element, so parsing documents with many nested namespace bindings grows quadratically in time and retained memory. This can trigger an OutOfMemoryError in applications that accept untrusted XML input.

Remediation

Upgrade org.jsoup:jsoup to version 1.23.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity
new

Improper Neutralization

  • Vulnerable module: net.minidev:json-smart
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0

Overview

net.minidev:json-smart is a Java JSON parser.

Affected versions of this package are vulnerable to Improper Neutralization via the parseInner function in the JSONParserBase parser. An attacker can evade JSONValue.parseStrict or isValidJsonStrict by sending a valid JSON value followed by a literal 0x1A character and malformed content; parseInner mistakes the character for end-of-input and skips the trailing-data check. Applications that rely on these strict-validation methods can accept input that downstream parsers such as Jackson or Gson interpret differently.

Remediation

There is no fixed version for net.minidev:json-smart.

References

Improper Neutralization vulnerability report

medium severity
new

Inefficient Algorithmic Complexity

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with ClassWriter.COMPUTE_FRAMES; their methods make frame computation’s fixpoint algorithm converge slowly.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Inefficient Algorithmic Complexity vulnerability report

medium severity
new

Inefficient Algorithmic Complexity

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames() and computeMaxStackAndLocal() methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTE_FRAMES or COMPUTE_MAXS, it allocates excessive Edge objects, causing an OutOfMemoryError that crashes the JVM.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Inefficient Algorithmic Complexity vulnerability report

medium severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via readBootstrapMethodsAttribute() in ClassReader. When an application parses an attacker-supplied class file, a crafted BootstrapMethods attribute with an unchecked declared length can trigger an allocation of roughly 2 GB from a file of about 100 bytes, causing an OutOfMemoryError that crashes the JVM or the thread processing the class.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors() method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM processes the subroutine.

Notes

  • The attacker must get a user to load or process the crafted class file.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity
new

Uncontrolled Recursion

  • Vulnerable module: org.ow2.asm:asm
  • Introduced through: net.minidev:json-smart@2.6.0 and com.jayway.jsonpath:json-path@3.0.0

Detailed paths

  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1
  • Introduced through: Cantara/Whydah-TypeLib@Cantara/Whydah-TypeLib › com.jayway.jsonpath:json-path@3.0.0 › net.minidev:json-smart@2.6.0 › net.minidev:accessors-smart@2.6.0 › org.ow2.asm:asm@9.7.1

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the parseType method in SignatureReader. An attacker can trigger a StackOverflowError and disrupt class transformation by supplying a crafted class file with a Signature attribute containing deeply nested generic type arguments.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

Uncontrolled Recursion vulnerability report