Vulnerabilities

 2 via 4 paths

Dependencies

 116

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity
new

CRLF Injection

  • Vulnerable module: io.micrometer:micrometer-core
  • Introduced through: org.springframework.ldap:spring-ldap-core@4.0.4 and org.springframework.security:spring-security-ldap@7.1.1

Detailed paths

  • Introduced through: ligoj/plugin-id-ldap-embedded@ligoj/plugin-id-ldap-embedded › org.springframework.ldap:spring-ldap-core@4.0.4 › io.micrometer:micrometer-core@1.16.6
  • Introduced through: ligoj/plugin-id-ldap-embedded@ligoj/plugin-id-ldap-embedded › org.springframework.security:spring-security-ldap@7.1.1 › org.springframework.ldap:spring-ldap-core@4.0.4 › io.micrometer:micrometer-core@1.16.6

Overview

Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing the generated StatsD or log output to break into additional lines.

Notes

  • Additional fixes are available for earlier versions under Enterprise Support (see the Spring Security Advisory for additional details)

Remediation

Upgrade io.micrometer:micrometer-core to version 1.16.7, 1.17.1 or higher.

References

CRLF Injection vulnerability report

high severity
new

Missing Release of Memory after Effective Lifetime

  • Vulnerable module: io.micrometer:micrometer-core
  • Introduced through: org.springframework.ldap:spring-ldap-core@4.0.4 and org.springframework.security:spring-security-ldap@7.1.1

Detailed paths

  • Introduced through: ligoj/plugin-id-ldap-embedded@ligoj/plugin-id-ldap-embedded › org.springframework.ldap:spring-ldap-core@4.0.4 › io.micrometer:micrometer-core@1.16.6
    Remediation: Upgrade to org.springframework.ldap:spring-ldap-core@4.1.0.
  • Introduced through: ligoj/plugin-id-ldap-embedded@ligoj/plugin-id-ldap-embedded › org.springframework.security:spring-security-ldap@7.1.1 › org.springframework.ldap:spring-ldap-core@4.0.4 › io.micrometer:micrometer-core@1.16.6
    Remediation: Upgrade to org.springframework.security:spring-security-ldap@7.1.1.

Overview

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the MicrometerHttpClientInterceptor. An attacker can cause unbounded memory consumption by repeatedly triggering asynchronous request failures before receiving a response, such as through connection resets or timeouts. This can ultimately lead to heap exhaustion and application crashes.

Remediation

Upgrade io.micrometer:micrometer-core to version 1.16.7, 1.17.1 or higher.

References

Missing Release of Memory after Effective Lifetime vulnerability report