Vulnerabilities

 1 via 1 paths

Dependencies

 16

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity

CRLF Injection

  • Vulnerable module: io.micrometer:micrometer-core
  • Introduced through: org.springframework.ldap:spring-ldap-core@4.1.1

Detailed paths

  • Introduced through: ligoj/plugin-id-ldap-embedded@ligoj/plugin-id-ldap-embedded › org.springframework.ldap:spring-ldap-core@4.1.1 › io.micrometer:micrometer-core@1.17.0
    Remediation: Upgrade to org.springframework.ldap:spring-ldap-core@4.1.2.

Overview

Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing the generated StatsD or log output to break into additional lines.

Notes

  • Additional fixes are available for earlier versions under Enterprise Support (see the Spring Security Advisory for additional details)

Remediation

Upgrade io.micrometer:micrometer-core to version 1.16.7, 1.17.1 or higher.

References

CRLF Injection vulnerability report