Vulnerabilities

 22 via 67 paths

Dependencies

 81

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 22
  • 5
Severity
  • 2
  • 6
  • 19
Status
  • 27
  • 0
  • 0

critical severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the DatabindContext._resolveAndValidateGeneric() method, which validates only the raw container class of a type identifier against the configured PolymorphicTypeValidator and not its nested generic type arguments. An attacker who controls the type identifier can instantiate a denied class, and reach unauthenticated remote code execution through an available gadget, by embedding that class as a generic parameter of an allowlisted container such as java.util.ArrayList<com.evil.Gadget>, which passes validation while the nested type is loaded, instantiated, and populated with attacker-controlled values. Exploitation requires polymorphic type validation to be enabled with a configured validator, the application to deserialize untrusted JSON, and a suitable gadget class on the classpath.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

Deserialization of Untrusted Data vulnerability report

critical severity

Incomplete List of Disallowed Inputs

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() method, which allowlists an array based only on clazz.isArray() and does not validate the array's component type. An attacker who controls the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array, because array elements without per-element type identifiers are constructed directly with no further validator check.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

Incomplete List of Disallowed Inputs vulnerability report

high severity

Improper Authentication

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-websocket@11.0.22 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authentication in the EncryptionInterceptor process of the cluster component. An attacker can gain unauthorized access or perform unauthorized actions by replaying previously captured authentication data.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

Improper Authentication vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: com.fasterxml.jackson.core:jackson-core
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6 › com.fasterxml.jackson.core:jackson-core@2.18.6

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the enforcement of document length constraints in blocking, async, and DataInput parser processes. An attacker can cause excessive resource consumption by submitting oversized JSON documents that bypass configured size limits.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.7, 2.21.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Detection of Error Condition Without Action

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-websocket@11.0.22 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to improper handling of invalid certificate revocation list (CRL) configurations in the FFM connector. An attacker can bypass intended certificate validation by supplying an invalid CRL configuration.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

Detection of Error Condition Without Action vulnerability report

high severity
new

Incorrect Authorization

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling properties annotated with both @JsonView and @JsonUnwrapped. An attacker can modify data that should be restricted to a higher-privileged view by supplying crafted JSON input.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

Incorrect Authorization vulnerability report

high severity
new

Incorrect Authorization

  • Vulnerable module: tools.jackson.core:jackson-databind
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-jackson@4.1.0 › org.springframework.boot:spring-boot-jackson@4.1.0 › tools.jackson.core:jackson-databind@3.1.4

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling properties annotated with both @JsonView and @JsonUnwrapped. An attacker can modify data that should be restricted to a higher-privileged view by supplying crafted JSON input.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.5, 3.2.1 or higher.

References

Incorrect Authorization vulnerability report

high severity

Expression Injection

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-jackson@4.1.0 › org.springframework.boot:spring-boot-starter@4.1.0 › org.springframework.boot:spring-boot-starter-logging@4.1.0 › ch.qos.logback:logback-classic@1.5.34 › ch.qos.logback:logback-core@1.5.34
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter@4.1.0 › org.springframework.boot:spring-boot-starter-logging@4.1.0 › ch.qos.logback:logback-classic@1.5.34 › ch.qos.logback:logback-core@1.5.34

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of <if> configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user who can modify the logback configuration can execute arbitrary code by writing an <if> condition that evades that denylist, either through references it did not cover such as Runtime or springframework, or through Unicode escape sequences like \u that reconstruct the blocked new operator. Exploitation requires write access to the logback configuration and the use of conditional <if> processing with Janino present on the classpath.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.36 or higher.

References

Expression Injection vulnerability report

medium severity

Improperly Controlled Modification of Dynamically-Determined Object Attributes

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability report

medium severity
new

Improperly Controlled Modification of Dynamically-Determined Object Attributes

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability report

medium severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Always-Incorrect Control Flow Implementation

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-websocket@11.0.22 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect control flow in the RewriteValve process. An attacker can bypass intended rewrite rules by crafting requests that exploit the improper evaluation of OR chains in conditions.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

Always-Incorrect Control Flow Implementation vulnerability report

medium severity
new

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-api
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-jackson@4.1.0 › org.springframework.boot:spring-boot-starter@4.1.0 › org.springframework.boot:spring-boot-starter-logging@4.1.0 › org.apache.logging.log4j:log4j-to-slf4j@2.25.4 › org.apache.logging.log4j:log4j-api@2.25.4
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter@4.1.0 › org.springframework.boot:spring-boot-starter-logging@4.1.0 › org.apache.logging.log4j:log4j-to-slf4j@2.25.4 › org.apache.logging.log4j:log4j-api@2.25.4

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the MapMessage.asJson() method, which emits the bare NaN, Infinity, or -Infinity tokens instead of an RFC 8259-compliant representation. An attacker can emit malformed JSON that corrupts the enclosing log record or disrupts downstream log ingestion and parsing by supplying non-finite floating-point values that the application records in a logged MapMessage. Exploitation requires the application to use the message resolver of JsonTemplateLayout, or another layout relying on MapMessage.asJson(), and to log a MapMessage holding attacker-controlled floating-point values.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-34481.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ASN1ObjectIdentifier. An attacker can cause excessive resource consumption by submitting specially crafted ASN.1 Object Identifiers, potentially leading to service disruption.

Note: This issue only applies to applications which do consume unvetted, or otherwise unvalidated, ASN.1 encodings.

Remediation

A fix was pushed into the master branch but not yet published.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper processing of large name constraint structures in PKIXCertPathReviewer. An attacker can cause excessive resource allocation by submitting specially crafted ASN.1 objects, potentially leading to service disruption.

Workaround

This vulnerability can be mitigated by limiting the size of ASN.1 objects that can be loaded from untrusted sources, thereby capping the maximum size of a Name Constraints structure.

Remediation

A fix was pushed into the master branch but not yet published.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Observable Discrepancy

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Observable Discrepancy due to the timing difference between exceptions thrown when processing RSA key exchange handshakes, AKA Marvin.

Note: The implemented fix mitigates the leakage of data via the PKCS#1 interface, but does not fully alleviate the side-channel as it allows cases in which the padding check fails but the handshake succeeds.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Observable Discrepancy vulnerability report

medium severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') within the org.bouncycastle.openssl.PEMParser class. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError.

Workaround

The attack can be avoided by filtering PEM requests containing EXTERNAL tagged encodings.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

medium severity
new

Incorrect Authorization

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.core:jackson-databind@2.18.6
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7 › com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.18.6 › com.fasterxml.jackson.core:jackson-databind@2.18.6

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the deserializeUsingPropertyBasedWithExternalTypeId file. An attacker can populate restricted creator properties from untrusted input by crafting JSON that exploits the lack of view checks on parameters annotated with both @JsonView and @JsonTypeInfo(include=As.EXTERNAL_PROPERTY). This allows unauthorized assignment of sensitive fields, even when a restrictive view is active, by injecting values through polymorphic type information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5 or higher.

References

Incorrect Authorization vulnerability report

medium severity

Always-Incorrect Control Flow Implementation

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-websocket@11.0.22 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization constraints are present. An attacker can bypass intended access restrictions by exploiting the absence of these constraints in the logged configuration.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

Always-Incorrect Control Flow Implementation vulnerability report

medium severity

Improper Authorization

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@4.1.0

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.apache.tomcat.embed:tomcat-embed-websocket@11.0.22 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.springframework.boot:spring-boot-starter-web@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat@4.1.0 › org.springframework.boot:spring-boot-starter-tomcat-runtime@4.1.0 › org.springframework.boot:spring-boot-tomcat@4.1.0 › org.apache.tomcat.embed:tomcat-embed-core@11.0.22

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the default servlet when certain HTTP methods or method omissions are configured. An attacker can gain unauthorized access to protected resources by sending requests using HTTP methods that are not properly restricted.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

Improper Authorization vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the solveQuadraticEquation() function used for certificate verification in ECCurve.java. Passing a large f2m parameter can cause excessive CPU consumption.

Remediation

There is no fixed version for org.bouncycastle:bcprov-jdk15on.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Information Exposure

  • Vulnerable module: org.bouncycastle:bcprov-jdk15on
  • Introduced through: org.bouncycastle:bcprov-jdk15on@1.70

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › org.bouncycastle:bcprov-jdk15on@1.70

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Information Exposure due to missing validation for the X.500 name of any certificate, subject, or issuer. The presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data.

Note:

The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.

Remediation

A fix was pushed into the master branch but not yet published.

References

Information Exposure vulnerability report

medium severity

Dual license: LGPL-2.1, MPL-2.0

  • Module: com.github.librepdf:openpdf
  • Introduced through: net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › com.github.librepdf:openpdf@1.3.43.jaspersoft.1

Dual license: LGPL-2.1, MPL-2.0

Dual license: LGPL-2.1, MPL-2.0 vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: junit:junit@4.13.2 and net.sf.barcode4j:barcode4j@2.1

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › junit:junit@4.13.2
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.barcode4j:barcode4j@2.1 › commons-cli:commons-cli@1.0 › commons-lang:commons-lang@1.0 › junit:junit@4.13.2

EPL-1.0 license

EPL-1.0 license vulnerability report

medium severity

LGPL-2.0 license

  • Module: net.sf.jasperreports:jasperreports
  • Introduced through: net.sf.jasperreports:jasperreports@7.0.7 and net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports@7.0.7
  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7 › net.sf.jasperreports:jasperreports@7.0.7

LGPL-2.0 license

LGPL-2.0 license vulnerability report

medium severity

LGPL-2.0 license

  • Module: net.sf.jasperreports:jasperreports-fonts
  • Introduced through: net.sf.jasperreports:jasperreports-fonts@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-fonts@7.0.7

LGPL-2.0 license

LGPL-2.0 license vulnerability report

medium severity

LGPL-2.0 license

  • Module: net.sf.jasperreports:jasperreports-pdf
  • Introduced through: net.sf.jasperreports:jasperreports-pdf@7.0.7

Detailed paths

  • Introduced through: arachan/JasperReportBoot@arachan/JasperReportBoot › net.sf.jasperreports:jasperreports-pdf@7.0.7

LGPL-2.0 license

LGPL-2.0 license vulnerability report