Vulnerabilities |
12 via 23 paths |
|---|---|
Dependencies |
78 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
critical severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the DatabindContext._resolveAndValidateGeneric() method, which validates only the raw container class of a type identifier against the configured PolymorphicTypeValidator and not its nested generic type arguments. An attacker who controls the type identifier can instantiate a denied class, and reach unauthenticated remote code execution through an available gadget, by embedding that class as a generic parameter of an allowlisted container such as java.util.ArrayList<com.evil.Gadget>, which passes validation while the nested type is loaded, instantiated, and populated with attacker-controlled values. Exploitation requires polymorphic type validation to be enabled with a configured validator, the application to deserialize untrusted JSON, and a suitable gadget class on the classpath.
Details
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.
Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.
References
critical severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() method, which allowlists an array based only on clazz.isArray() and does not validate the array's component type. An attacker who controls the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array, because array elements without per-element type identifiers are constructed directly with no further validator check.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.
References
high severity
new
- Vulnerable module: ch.qos.logback:logback-core
- Introduced through: ch.qos.logback:logback-classic@1.5.32
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › ch.qos.logback:logback-classic@1.5.32 › ch.qos.logback:logback-core@1.5.32Remediation: Upgrade to ch.qos.logback:logback-classic@1.5.36.
Overview
ch.qos.logback:logback-core is a logback-core module.
Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of <if> configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user who can modify the logback configuration can execute arbitrary code by writing an <if> condition that evades that denylist, either through references it did not cover such as Runtime or springframework, or through Unicode escape sequences like \u that reconstruct the blocked new operator. Exploitation requires write access to the logback configuration and the use of conditional <if> processing with Janino present on the classpath.
Remediation
Upgrade ch.qos.logback:logback-core to version 1.5.36 or higher.
References
medium severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._renameProperties() and BeanDeserializerFactory.addBeanProps() methods, which rename rather than drop a property whose getter carries @JsonProperty and whose setter carries @JsonIgnore, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes hasField()==true and builds a writable FieldProperty for the backing field. Exploitation requires MapperFeature.INFER_PROPERTY_MUTATORS to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.
References
medium severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.5.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.
References
medium severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.
References
medium severity
new
- Vulnerable module: ch.qos.logback:logback-classic
- Introduced through: ch.qos.logback:logback-classic@1.5.32
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › ch.qos.logback:logback-classic@1.5.32Remediation: Upgrade to ch.qos.logback:logback-classic@1.5.33.
Overview
ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.
Workaround
This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.
Details
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.
Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.
Remediation
Upgrade ch.qos.logback:logback-classic to version 1.5.33 or higher.
References
medium severity
new
- Vulnerable module: ch.qos.logback:logback-core
- Introduced through: ch.qos.logback:logback-classic@1.5.32
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › ch.qos.logback:logback-classic@1.5.32 › ch.qos.logback:logback-core@1.5.32Remediation: Upgrade to ch.qos.logback:logback-classic@1.5.33.
Overview
ch.qos.logback:logback-core is a logback-core module.
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.
Workaround
This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.
Details
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.
Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.
Remediation
Upgrade ch.qos.logback:logback-core to version 1.5.33 or higher.
References
medium severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Incorrect Authorization in the BeanDeserializer._deserializeUsingPropertyBased method, whose property-buffering branch omits the prop.visibleInView(activeView) check that the creator-property branch performs. An attacker can populate view-restricted setterless collection or map properties, such as admin-only fields, from untrusted JSON by supplying values for them during deserialization, bypassing @JsonView protection. This affects only setterless collection or map properties annotated with a restricted @JsonView and reached through the property-based creator path.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.
References
medium severity
new
- Vulnerable module: com.fasterxml.jackson.core:jackson-databind
- Introduced through: com.fasterxml.jackson.core:jackson-databind@2.21.2 and io.helidon.media:helidon-media-jackson@2.6.14
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.fasterxml.jackson.core:jackson-databind@2.21.2Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.21.4.
-
Introduced through: Cantara/visuale@Cantara/visuale › io.helidon.media:helidon-media-jackson@2.6.14 › com.fasterxml.jackson.core:jackson-databind@2.21.2
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Incorrect Authorization in the UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method, which replays buffered JSON into creator parameters without consulting prop.visibleInView(activeView). An attacker can set view-restricted constructor parameters annotated with both @JsonView and @JsonUnwrapped, such as admin-only fields, from untrusted JSON by supplying them during deserialization while a more restrictive view is active, defeating the @JsonView write-side authorization boundary.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.
References
medium severity
- Module: junit:junit
- Introduced through: org.glassfish.jersey.media:jersey-media-json-binding@2.48
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.12
-
Introduced through: Cantara/visuale@Cantara/visuale › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › org.eclipse:yasson@1.0.11 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.12
EPL-1.0 license
low severity
- Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
- Introduced through: com.slack.api:slack-api-client@1.48.0
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › com.slack.api:slack-api-client@1.48.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
-
Introduced through: Cantara/visuale@Cantara/visuale › com.slack.api:slack-api-client@1.48.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
-
Introduced through: Cantara/visuale@Cantara/visuale › com.slack.api:slack-api-client@1.48.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
-
Introduced through: Cantara/visuale@Cantara/visuale › com.slack.api:slack-api-client@1.48.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Overview
org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.
Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.
Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".
PoC by JLLeitschuh
package org.jlleitschuh.sandbox
import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files
class KotlinTempDirectoryPermissionCheck {
@Test
fun `kotlin check default directory permissions`() {
val dir = createTempDir()
runLS(dir.parentFile, dir) // Prints drwxr-xr-x
}
@Test
fun `Files check default directory permissions`() {
val dir = Files.createTempDirectory("random-directory")
runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
}
@Test
fun `kotlin check default file permissions`() {
val file = createTempFile()
runLS(file.parentFile, file) // Prints -rw-r--r--
}
@Test
fun `Files check default file permissions`() {
val file = Files.createTempFile("random-file", ".txt")
runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
}
private fun runLS(file: File, lookingFor: File) {
val processBuilder = ProcessBuilder()
processBuilder.command("ls", "-l", file.absolutePath)
try {
val process = processBuilder.start()
val output = StringBuilder()
val reader = BufferedReader(
InputStreamReader(process.inputStream)
)
reader.lines().forEach { line ->
if (line.contains("total")) {
output.append(line).append('\n')
}
if (line.contains(lookingFor.name)) {
output.append(line).append('\n')
}
}
val exitVal = process.waitFor()
if (exitVal == 0) {
println("Success!")
println(output)
} else {
//abnormal...
}
} catch (e: IOException) {
e.printStackTrace()
} catch (e: InterruptedException) {
e.printStackTrace()
}
}
}
Remediation
Upgrade org.jetbrains.kotlin:kotlin-stdlib to version 2.1.0 or higher.
References
low severity
- Vulnerable module: junit:junit
- Introduced through: org.glassfish.jersey.media:jersey-media-json-binding@2.48
Detailed paths
-
Introduced through: Cantara/visuale@Cantara/visuale › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.12Remediation: Upgrade to org.glassfish.jersey.media:jersey-media-json-binding@2.48.
-
Introduced through: Cantara/visuale@Cantara/visuale › org.glassfish.jersey.media:jersey-media-json-binding@2.48 › org.eclipse:yasson@1.0.11 › jakarta.json.bind:jakarta.json.bind-api@1.0.2 › junit:junit@4.12Remediation: Upgrade to org.glassfish.jersey.media:jersey-media-json-binding@2.48.
Overview
junit:junit is an unit testing framework for Java
Affected versions of this package are vulnerable to Information Exposure. The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.
Note: This vulnerability does not allow other users to overwrite the contents of these directories or files. This only affects Unix like systems.
Remediation
Upgrade junit:junit to version 4.13.1 or higher.