Vulnerabilities

 1 via 12 paths

Dependencies

 48

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

low severity
new

Symbolic Name not Mapping to Correct Object

  • Vulnerable module: org.objenesis:objenesis
  • Introduced through: io.vertx:vertx-core@5.2.2, io.vertx:vertx-web-client@5.2.2 and others

Detailed paths

  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-native-quic@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web-client@5.2.2 › io.vertx:vertx-uri-template@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web-client@5.2.2 › io.vertx:vertx-uri-template@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web-client@5.2.2 › io.vertx:vertx-uri-template@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web@5.2.2 › io.vertx:vertx-bridge-common@5.2.2 › io.vertx:vertx-eventbus-bridge-common@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web@5.2.2 › io.vertx:vertx-bridge-common@5.2.2 › io.vertx:vertx-eventbus-bridge-common@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web-client@5.2.2 › io.vertx:vertx-uri-template@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-native-quic@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web@5.2.2 › io.vertx:vertx-bridge-common@5.2.2 › io.vertx:vertx-eventbus-bridge-common@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents › io.vertx:vertx-web@5.2.2 › io.vertx:vertx-bridge-common@5.2.2 › io.vertx:vertx-eventbus-bridge-common@5.2.2 › io.vertx:vertx-core@5.2.2 › io.netty:netty-codec-http3@4.2.19.Final › io.netty:netty-codec-native-quic@4.2.19.Final › io.netty:netty-codec-classes-quic@4.2.19.Final › io.netty:netty-codec-base@4.2.19.Final › org.mockito:mockito-core@4.11.0 › org.objenesis:objenesis@3.3

Overview

Affected versions of this package are vulnerable to Symbolic Name not Mapping to Correct Object through the getInstantiatorOf process. An attacker can cause objects from one class loader to be substituted into another by exploiting instantiator caching keyed on class name, potentially leading to unexpected behavior, data corruption, or application crashes by introducing wrong-class objects.

Remediation

Upgrade org.objenesis:objenesis to version 3.6 or higher.

References

Symbolic Name not Mapping to Correct Object vulnerability report