Vulnerabilities

 2 via 2 paths

Dependencies

 12

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: commons-lang:commons-lang
  • Introduced through: commons-lang:commons-lang@2.6

Detailed paths

  • Introduced through: adaptris/interlok-vcs-git@adaptris/interlok-vcs-git › commons-lang:commons-lang@2.6

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

Uncontrolled Recursion vulnerability report

medium severity
new

Improper Check for Certificate Revocation

  • Vulnerable module: com.github.mwiede:jsch
  • Introduced through: com.github.mwiede:jsch@0.2.26

Detailed paths

  • Introduced through: adaptris/interlok-vcs-git@adaptris/interlok-vcs-git › com.github.mwiede:jsch@0.2.26
    Remediation: Upgrade to com.github.mwiede:jsch@2.28.6.

Overview

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the known_hosts parser, where HostKey.name2type() lacks OpenSSH certificate-type entries such as ssh-ed25519-cert-v01@openssh.com in its static table, so a @revoked line authored with a certificate-type token fails the lookup and is stored as an UNKNOWN, marker-less entry. An attacker holding a compromised host certificate can pass host verification despite that revocation entry, because UNKNOWN entries are excluded from getHostKey() and never reach OpenSshCertificateUtil.getRevokedKeys(), when the client's known_hosts @revoked line was written with the certificate type string. This requires OpenSSH certificate-based host authentication with StrictHostKeyChecking=yes, and the @revoked entry to have been authored using the certificate-type token rather than the base key type.

Workaround

This vulnerability can be avoided by authoring the @revoked known_hosts entry with the base key type (for example ssh-ed25519) rather than the certificate-type token, so the parser recognizes the type and applies the revocation.

Remediation

Upgrade com.github.mwiede:jsch to version 2.28.6 or higher.

References

Improper Check for Certificate Revocation vulnerability report