Vulnerabilities

 29 via 228 paths

Dependencies

 43

Source

 GitHub

Commit

 develop

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 29
  • 2
Severity
  • 1
  • 13
  • 15
  • 2
Status
  • 31
  • 0
  • 0

critical severity

Remote Code Execution (RCE)

  • Vulnerable module: org.scala-lang:scala-library
  • Introduced through: org.scala-lang:scala-library@2.13.1, com.pauldijou:jwt-core_2.13@4.2.0 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to org.scala-lang:scala-library@2.13.9.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.pauldijou:jwt-core_2.13@4.2.0 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › io.spray:spray-json_2.13@1.3.5 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-slf4j_2.13@2.6.1 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-slf4j_2.13@2.7.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.7.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.parboiled:parboiled_2.13@2.1.8 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to org.parboiled:parboiled_2.13@2.4.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › de.upb.cs.swt.delphi:delphi-core_2.13@0.9.2 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.scalactic:scalactic_2.13@3.1.0 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to org.scalactic:scalactic_2.13@3.2.15.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@8.5.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.scalactic:scalactic_2.13@3.1.0 › org.scala-lang:scala-reflect@2.13.1 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to org.scalactic:scalactic_2.13@3.2.15.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.sksamuel.exts:exts_2.13@1.61.1 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-slf4j_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-slf4j_2.13@2.7.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.7.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › io.spray:spray-json_2.13@1.3.5 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › de.upb.cs.swt.delphi:delphi-core_2.13@0.9.2 › io.spray:spray-json_2.13@1.3.5 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe:ssl-config-core_2.13@0.4.1 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.parboiled:parboiled_2.13@2.1.8 › com.chuusai:shapeless_2.13@2.3.3 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to org.parboiled:parboiled_2.13@2.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › de.upb.cs.swt.delphi:delphi-core_2.13@0.9.2 › org.parboiled:parboiled_2.13@2.1.8 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.sksamuel.exts:exts_2.13@1.61.1 › org.scala-lang:scala-reflect@2.13.1 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-slf4j_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1 › org.scala-lang.modules:scala-java8-compat_2.13@0.9.0 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1 › org.scala-lang.modules:scala-java8-compat_2.13@0.9.0 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › com.typesafe.akka:akka-parsing_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe:ssl-config-core_2.13@0.4.1 › org.scala-lang.modules:scala-parser-combinators_2.13@1.1.2 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › de.upb.cs.swt.delphi:delphi-core_2.13@0.9.2 › org.parboiled:parboiled_2.13@2.1.8 › com.chuusai:shapeless_2.13@2.3.3 › org.scala-lang:scala-library@2.13.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › com.typesafe.akka:akka-parsing_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.4.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10 › com.typesafe.akka:akka-parsing_2.13@10.1.10 › org.scala-lang:scala-library@2.13.1
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.4.0.

Overview

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to a vulnerable Java deserialization chain when used in conjunction with LazyList object deserialization, which may allow execution of an arbitrary Function0.

Remediation

Upgrade org.scala-lang:scala-library to version 2.13.9 or higher.

References

Remote Code Execution (RCE) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-core
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.15.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Denial of Service (DoS) due to missing input size validation when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values, causing the application to exhaust all available resources.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.15.0-rc1 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Stack-based Buffer Overflow

  • Vulnerable module: com.fasterxml.jackson.core:jackson-core
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.15.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Stack-based Buffer Overflow due to the parse process, which accepts an unlimited input file with deeply nested data. An attacker can cause a stack overflow and crash the application by providing input files with excessively deep nesting.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.15.0-rc1 or higher.

References

Stack-based Buffer Overflow vulnerability report

high severity

Stack-based Buffer Overflow

  • Vulnerable module: com.google.protobuf:protobuf-java
  • Introduced through: com.typesafe.akka:akka-stream_2.13@2.6.1

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-protobuf-v3_2.13@2.6.1 › com.google.protobuf:protobuf-java@3.10.0
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.6.5.

Overview

com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the parsing of nested groups or series of SGROUP tags as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields. An attacker can cause infinite recursion by sending malicious Protocol Buffer data.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-java to version 3.25.5, 4.27.5, 4.28.2 or higher.

References

Stack-based Buffer Overflow vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: com.typesafe.akka:akka-http-core_2.13
  • Introduced through: com.typesafe.akka:akka-http_2.13@10.1.10, com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.5.3.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.5.3.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.5.3.

Overview

com.typesafe.akka:akka-http-core_2.13 is a modern, fast, asynchronous, streaming-first HTTP server and client.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.typesafe.akka:akka-http-core_2.13 to version 10.5.3 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.10.5.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.4.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.4.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.8.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. A flaw was found in FasterXML Jackson Databind, where it does not have entity expansion secured properly in the DOMDeserializer class. The highest threat from this vulnerability is data integrity.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.7, 2.10.5.1 or higher.

References

XML External Entity (XXE) Injection vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.12.6.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Denial of Service (DoS) via a large depth of nested objects.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.12.6.1, 2.13.2.1 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: com.google.protobuf:protobuf-java
  • Introduced through: com.typesafe.akka:akka-stream_2.13@2.6.1

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-protobuf-v3_2.13@2.6.1 › com.google.protobuf:protobuf-java@3.10.0
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.6.5.

Overview

com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Denial of Service (DoS). An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses.

Note: Protobuf javalite users are not affected.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-java to version 3.16.1, 3.18.2, 3.19.2 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: com.google.protobuf:protobuf-java
  • Introduced through: com.typesafe.akka:akka-stream_2.13@2.6.1

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-protobuf-v3_2.13@2.6.1 › com.google.protobuf:protobuf-java@3.10.0
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.6.5.

Overview

com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Denial of Service (DoS) in MessageReflection.java due to a text format parsing issue. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back and forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-java to version 3.16.3, 3.19.6, 3.20.3, 3.21.7 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Improper Resource Shutdown or Release

  • Vulnerable module: com.typesafe.akka:akka-http-core_2.13
  • Introduced through: com.typesafe.akka:akka-http_2.13@10.1.10, com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.1.15.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.1.15.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.1.15.

Overview

com.typesafe.akka:akka-http-core_2.13 is a modern, fast, asynchronous, streaming-first HTTP server and client.

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release which can encounter stack exhaustion while parsing HTTP headers. It allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

Remediation

Upgrade com.typesafe.akka:akka-http-core_2.13 to version 10.2.7, 10.1.15 or higher.

References

Improper Resource Shutdown or Release vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: ch.qos.logback:logback-classic
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.2.13.

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker can mount a denial-of-service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.2.13, 1.3.12, 1.4.12 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: ch.qos.logback:logback-classic
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.2.13.

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via the logback receiver component. An attacker can mount a denial-of-service attack by sending poisoned data.

Note:

Successful exploitation requires the logback-receiver component being enabled and also reachable by the attacker.

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.2.13, 1.3.14, 1.4.14 or higher.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.2.13.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker can mount a denial-of-service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade ch.qos.logback:logback-core to version 1.2.13, 1.3.12, 1.4.12 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.2.13.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via the logback receiver component. An attacker can mount a denial-of-service attack by sending poisoned data.

Note:

Successful exploitation requires the logback-receiver component being enabled and also reachable by the attacker.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.2.13, 1.3.14, 1.4.14 or higher.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

medium severity

Improper Neutralization of Special Elements

  • Vulnerable module: ch.qos.logback:logback-classic
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.3.15.

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements via the JaninoEventEvaluator extension. An attacker can execute arbitrary code by compromising an existing logback configuration file or injecting an environment variable before program execution.

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.3.15, 1.5.13 or higher.

References

Improper Neutralization of Special Elements vulnerability report

medium severity

External Initialization of Trusted Variables or Data Stores

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.5.19.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to External Initialization of Trusted Variables or Data Stores via the conditional processing of the logback.xml configuration file when both the Janino library and Spring Framework are present on the class path. An attacker can execute arbitrary code by compromising an existing configuration file or injecting a malicious environment variable before program execution. This is only exploitable if the attacker has write access to a configuration file or can set a malicious environment variable.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.19 or higher.

References

External Initialization of Trusted Variables or Data Stores vulnerability report

medium severity

Improper Neutralization of Special Elements

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.3.15.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements via the JaninoEventEvaluator extension. An attacker can execute arbitrary code by compromising an existing logback configuration file or injecting an environment variable before program execution.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.3.15, 1.5.13 or higher.

References

Improper Neutralization of Special Elements vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.12.6.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Denial of Service (DoS) when using JDK serialization to serialize and deserialize JsonNode values. It is possible for the attacker to send a 4-byte length payload, with a value of Integer.MAX_VALUE , that will eventually cause large buffer allocation and out of heap memory.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.13.1, 2.12.6 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.12.7.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.12.4.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.12.4.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the _deserializeFromArray() function in BeanDeserializer, due to resource exhaustion when processing a deeply nested array.

NOTE: For this vulnerability to be exploitable the non-default DeserializationFeature must be enabled.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.12.7.1, 2.13.4 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.12.7.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@8.5.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@8.5.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the _deserializeWrappedValue() function in StdDeserializer.java, due to resource exhaustion when processing deeply nested arrays.

NOTE: This vulnerability is only exploitable when the non-default UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.12.7.1, 2.13.4.1 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Denial of Service (DoS)

  • Vulnerable module: com.google.protobuf:protobuf-java
  • Introduced through: com.typesafe.akka:akka-stream_2.13@2.6.1

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-protobuf-v3_2.13@2.6.1 › com.google.protobuf:protobuf-java@3.10.0
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.6.5.

Overview

com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields cause objects to be converted back and forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.google.protobuf:protobuf-java to version 3.16.3, 3.19.6, 3.20.3, 3.21.7 or higher.

References

Denial of Service (DoS) vulnerability report

medium severity

Generation of Predictable Numbers or Identifiers

  • Vulnerable module: com.typesafe.akka:akka-actor_2.13
  • Introduced through: com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4, com.typesafe.akka:akka-slf4j_2.13@2.6.1 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.typesafe.akka:akka-actor_2.13@2.6.1
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-slf4j_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1
    Remediation: Upgrade to com.typesafe.akka:akka-slf4j_2.13@2.8.1.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-stream_2.13@2.6.1 › com.typesafe.akka:akka-actor_2.13@2.6.1
    Remediation: Upgrade to com.typesafe.akka:akka-stream_2.13@2.8.1.

Overview

com.typesafe.akka:akka-actor_2.13 is a toolkit for building highly concurrent, distributed, and resilient message-driven applications for Java and Scala.

Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers in the async-dns resolver component, which is used by Discovery in DNS mode and transitively by Cluster Bootstrap. It uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not validate (e.g., via TLS) the authenticity of the discovered service, this may result in exfiltration of application data (e.g., persistence events may be published to an unintended Kafka broker). If such validation is performed, then the poisoning constitutes a denial of access to the intended service.

The complexity of a successful attack using this vulnerability is high because the attacker must gather or guess details about the services accessible via the affected DNS server.

Remediation

Upgrade com.typesafe.akka:akka-actor_2.13 to version 2.8.1 or higher.

References

Generation of Predictable Numbers or Identifiers vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: org.apache.httpcomponents:httpclient
  • Introduced through: org.apache.httpcomponents:httpclient@4.5.9, com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.apache.httpcomponents:httpclient@4.5.9
    Remediation: Upgrade to org.apache.httpcomponents:httpclient@4.5.13.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › org.elasticsearch.client:elasticsearch-rest-client@6.7.2 › org.apache.httpcomponents:httpclient@4.5.9
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › org.elasticsearch.client:elasticsearch-rest-client@6.7.2 › org.apache.httpcomponents:httpclient@4.5.9

Overview

org.apache.httpcomponents:httpclient is a HttpClient component of the Apache HttpComponents project.

Affected versions of this package are vulnerable to Improper Input Validation. Apache HttpClient can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Remediation

Upgrade org.apache.httpcomponents:httpclient to version 4.5.13 or higher.

References

Improper Input Validation vulnerability report

medium severity

Information Exposure

  • Vulnerable module: com.fasterxml.jackson.core:jackson-core
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.10.1, com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.13.0.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
    Remediation: Upgrade to com.sksamuel.elastic4s:elastic4s-core_2.13@7.10.10.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.sksamuel.elastic4s:elastic4s-http-streams_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-http_2.13@6.7.4 › com.sksamuel.elastic4s:elastic4s-core_2.13@6.7.4 › com.fasterxml.jackson.module:jackson-module-scala_2.13@2.10.0 › com.fasterxml.jackson.module:jackson-module-paranamer@2.10.0 › com.fasterxml.jackson.core:jackson-databind@2.10.1 › com.fasterxml.jackson.core:jackson-core@2.10.0

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Information Exposure due to the JsonLocation._appendSourceDesc method. An attacker can access up to 500 bytes of unintended memory content by exploiting exception messages that incorrectly read from the beginning of a byte array instead of the logical payload start.

Workaround

This vulnerability can be mitigated by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.

PoC


byte[] buffer = new byte[1000];
System.arraycopy("SECRET".getBytes(), 0, buffer, 0, 6);
System.arraycopy("{ \"bad\": }".getBytes(), 0, buffer, 700, 10);

JsonFactory factory = new JsonFactory();
JsonParser parser = factory.createParser(buffer, 700, 20);
parser.nextToken(); // throws exception

// Exception message will include "SECRET"

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.13.0-rc1 or higher.

References

Information Exposure vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: com.typesafe.akka:akka-http-core_2.13
  • Introduced through: com.typesafe.akka:akka-http_2.13@10.1.10, com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.1.14.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.1.14.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10 › com.typesafe.akka:akka-http-core_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.1.14.

Overview

com.typesafe.akka:akka-http-core_2.13 is a modern, fast, asynchronous, streaming-first HTTP server and client.

Affected versions of this package are vulnerable to HTTP Request Smuggling. It allows multiple Transfer-Encoding headers.

Remediation

Upgrade com.typesafe.akka:akka-http-core_2.13 to version 10.2.4, 10.1.14 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Insufficient Hostname Verification

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.2.7.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Insufficient Hostname Verification. X.509 are not properly validated. By spoofing the TLS/SSL server via a certificate that appears valid, an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.2.7 or higher.

References

Insufficient Hostname Verification vulnerability report

medium severity

Creation of Temporary File With Insecure Permissions

  • Vulnerable module: com.typesafe.akka:akka-http_2.13
  • Introduced through: com.typesafe.akka:akka-http_2.13@10.1.10, com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 and others

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http_2.13@10.5.2.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-spray-json_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-spray-json_2.13@10.5.2.
  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › com.typesafe.akka:akka-http-testkit_2.13@10.1.10 › com.typesafe.akka:akka-http_2.13@10.1.10
    Remediation: Upgrade to com.typesafe.akka:akka-http-testkit_2.13@10.5.2.

Overview

Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions such that when it accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions and it is readable by other users on Linux or UNIX.

Note: This issue is similar to CVE-2022-41946.

Remediation

Upgrade com.typesafe.akka:akka-http_2.13 to version 10.5.2 or higher.

References

Creation of Temporary File With Insecure Permissions vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-classic
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

low severity

Information Exposure

  • Vulnerable module: commons-codec:commons-codec
  • Introduced through: org.apache.httpcomponents:httpclient@4.5.9

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › org.apache.httpcomponents:httpclient@4.5.9 › commons-codec:commons-codec@1.11

Overview

commons-codec:commons-codec is a package that contains simple encoder and decoders for various formats such as Base64 and Hexadecimal.

Affected versions of this package are vulnerable to Information Exposure. When there is no byte array value that can be encoded into a string the Base32 implementation does not reject it, and instead decodes it into an arbitrary value which can be re-encoded again using the same implementation. This allows for information exposure exploits such as tunneling additional information via seemingly valid base 32 strings.

Remediation

Upgrade commons-codec:commons-codec to version 1.14 or higher.

References

Information Exposure vulnerability report

low severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: ch.qos.logback:logback-core
  • Introduced through: ch.qos.logback:logback-classic@1.2.3

Detailed paths

  • Introduced through: delphi-hub/delphi-webapi@delphi-hub/delphi-webapi#develop › ch.qos.logback:logback-classic@1.2.3 › ch.qos.logback:logback-core@1.2.3
    Remediation: Upgrade to ch.qos.logback:logback-classic@1.3.15.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the SaxEventRecorder process. An attacker can forge requests by compromising logback configuration files in XML.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.3.15, 1.5.13 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report