Vulnerabilities

 10 via 12 paths

Dependencies

 13

Source

 GitHub

Commit

 c98cc259

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 8
  • 1
Status
  • 10
  • 0
  • 0

high severity

Denial of Service (DoS)

  • Vulnerable module: com.google.protobuf:protobuf-javalite
  • Introduced through: com.google.protobuf:protobuf-javalite@3.10.0

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › com.google.protobuf:protobuf-javalite@3.10.0
    Remediation: Upgrade to com.google.protobuf:protobuf-javalite@3.16.3.

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) in MessageReflection.java due to a text format parsing issue. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back and forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-javalite to version 3.16.3, 3.19.6, 3.20.3, 3.21.7 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Observable Timing Discrepancy

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Observable Timing Discrepancy via the PKCS#1 1.5 and OAEP decryption process. An attacker can recover ciphertexts via a side-channel attack by exploiting the Marvin security flaw. The PKCS#1 1.5 attack vector leaks data via javax.crypto.Cipher exceptions and the OAEP interface vector leaks via the bit size of the decrypted data.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Observable Timing Discrepancy vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: com.google.protobuf:protobuf-javalite
  • Introduced through: com.google.protobuf:protobuf-javalite@3.10.0

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › com.google.protobuf:protobuf-javalite@3.10.0
    Remediation: Upgrade to com.google.protobuf:protobuf-javalite@3.16.3.

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) via the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields cause objects to be converted back and forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-javalite to version 3.16.3, 3.19.6, 3.20.3, 3.21.7 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') within the org.bouncycastle.openssl.PEMParser class. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError.

Workaround

The attack can be avoided by filtering PEM requests containing EXTERNAL tagged encodings.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the solveQuadraticEquation() function used for certificate verification in ECCurve.java. Passing a large f2m parameter can cause excessive CPU consumption.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Timing Attack

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64
    Remediation: Upgrade to org.bouncycastle:bcpkix-jdk15on@1.66.

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Timing Attack. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

Remediation

Upgrade org.bouncycastle:bcprov-jdk15on to version 1.66 or higher.

References

Timing Attack vulnerability report

medium severity

Improper Locking

  • Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
  • Introduced through: org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.3.61 and org.jetbrains.kotlinx:kotlinx-coroutines-core@1.3.3

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.3.61 › org.jetbrains.kotlin:kotlin-stdlib@1.3.61
    Remediation: Upgrade to org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.6.0.
  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.jetbrains.kotlinx:kotlinx-coroutines-core@1.3.3 › org.jetbrains.kotlin:kotlin-stdlib@1.3.61
    Remediation: Upgrade to org.jetbrains.kotlinx:kotlinx-coroutines-core@1.4.3.

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Improper Locking due to inability to lock dependencies for Multiplatform Gradle Projects.

Remediation

Upgrade org.jetbrains.kotlin:kotlin-stdlib to version 1.6.0 or higher.

References

Improper Locking vulnerability report

medium severity

Cryptographic Issues

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64
    Remediation: Upgrade to org.bouncycastle:bcpkix-jdk15on@1.69.

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Cryptographic Issues via weak key-hash message authentication code (HMAC) that is only 16 bits long which can result in hash collisions, as a result of an error within the BKS version 1 keystore (BKS-V1) files and could lead to an attacker being able to affect the integrity of these files. This vulnerability was introduced following an incomplete fix for CVE-2018-5382.

Remediation

Upgrade org.bouncycastle:bcprov-jdk15on to version 1.69 or higher.

References

Cryptographic Issues vulnerability report

medium severity

Information Exposure

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcpkix-jdk15on@1.64

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.bouncycastle:bcpkix-jdk15on@1.64 › org.bouncycastle:bcprov-jdk15on@1.64

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Information Exposure due to missing validation for the X.500 name of any certificate, subject, or issuer. The presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data.

Note:

The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.

Remediation

A fix was pushed into the master branch but not yet published.

References

Information Exposure vulnerability report

low severity

Information Exposure

  • Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
  • Introduced through: org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.3.61 and org.jetbrains.kotlinx:kotlinx-coroutines-core@1.3.3

Detailed paths

  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.3.61 › org.jetbrains.kotlin:kotlin-stdlib@1.3.61
  • Introduced through: XYOracleNetwork/sdk-xyo-flutter@XYOracleNetwork/sdk-xyo-flutter#c98cc259eb70941c3349bcffa96c3ee211137c48 › org.jetbrains.kotlinx:kotlinx-coroutines-core@1.3.3 › org.jetbrains.kotlin:kotlin-stdlib@1.3.61

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.

Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

PoC by JLLeitschuh

package org.jlleitschuh.sandbox

import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files

class KotlinTempDirectoryPermissionCheck {
    @Test
    fun `kotlin check default directory permissions`() {
        val dir = createTempDir()
        runLS(dir.parentFile, dir) // Prints drwxr-xr-x
    }

    @Test
    fun `Files check default directory permissions`() {
        val dir = Files.createTempDirectory("random-directory")
        runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
    }

    @Test
    fun `kotlin check default file permissions`() {
        val file = createTempFile()
        runLS(file.parentFile, file) // Prints -rw-r--r--
    }

    @Test
    fun `Files check default file permissions`() {
        val file = Files.createTempFile("random-file", ".txt")
        runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
    }

    private fun runLS(file: File, lookingFor: File) {
        val processBuilder = ProcessBuilder()
        processBuilder.command("ls", "-l", file.absolutePath)
        try {
            val process = processBuilder.start()
            val output = StringBuilder()
            val reader = BufferedReader(
                InputStreamReader(process.inputStream)
            )
            reader.lines().forEach { line ->
                if (line.contains("total")) {
                    output.append(line).append('\n')
                }
                if (line.contains(lookingFor.name)) {
                    output.append(line).append('\n')
                }
            }
            val exitVal = process.waitFor()
            if (exitVal == 0) {
                println("Success!")
                println(output)
            } else {
                //abnormal...
            }
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: InterruptedException) {
            e.printStackTrace()
        }
    }
}

Remediation

There is no fixed version for org.jetbrains.kotlin:kotlin-stdlib.

References

Information Exposure vulnerability report