Vulnerabilities

 3 via 31 paths

Dependencies

 110

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
  • 1
Status
  • 3
  • 0
  • 0

critical severity
new

Deserialization of Untrusted Data

  • Vulnerable module: tools.jackson.core:jackson-databind
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.4

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › tools.jackson.core:jackson-databind@3.2.3
    Remediation: Upgrade to org.ligoj.bootstrap:bootstrap-business@5.0.5.
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › tools.jackson.core:jackson-databind@3.2.3
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › tools.jackson.jakarta.rs:jackson-jakarta-rs-json-provider@3.2.3 › tools.jackson.jakarta.rs:jackson-jakarta-rs-base@3.2.3 › tools.jackson.core:jackson-databind@3.2.3
    Remediation: Upgrade to org.ligoj.bootstrap:bootstrap-business@5.0.5.
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › io.github.vpelikh:swagger-integration-jakarta@3.0.0 › io.github.vpelikh:swagger-core-jakarta@3.0.0 › tools.jackson.core:jackson-databind@3.2.3
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › tools.jackson.jakarta.rs:jackson-jakarta-rs-json-provider@3.2.3 › tools.jackson.jakarta.rs:jackson-jakarta-rs-base@3.2.3 › tools.jackson.core:jackson-databind@3.2.3
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › io.github.vpelikh:swagger-integration-jakarta@3.0.0 › io.github.vpelikh:swagger-core-jakarta@3.0.0 › tools.jackson.dataformat:jackson-dataformat-yaml@3.2.3 › tools.jackson.core:jackson-databind@3.2.3

Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the _resolveAndValidateGeneric() and _validateTypeParameter() methods of the DatabindContext class. An attacker can instantiate arbitrary classes by supplying a class-name type ID whose generic arguments or array element type name a class that is not validated, because only the outer type is checked against the PolymorphicTypeValidator. Exploitation requires deserializing untrusted JSON with class-name type IDs, through annotation-based polymorphism or default typing, where the outer base type is approved, and a usable gadget class is on the classpath.

Workaround

This vulnerability can be avoided by using narrow subtype rules, preventing attackers from writing serialized cache or session values, or removing unnecessary dependencies that provide gadget classes.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-54512.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.8, 3.2.4 or higher.

References

Deserialization of Untrusted Data vulnerability report

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: org.glassfish.jaxb:jaxb-core
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.4

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.hibernate.orm:hibernate-core@7.4.13.Final › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.hibernate.orm:hibernate-scan-jandex@7.4.13.Final › org.hibernate.orm:hibernate-core@7.4.13.Final › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection in the createParserFactory and createDocumentBuilderFactory methods of the XmlFactory class, which set only XMLConstants.FEATURE_SECURE_PROCESSING on the factory and leave disallow-doctype-decl, external-general-entities, external-parameter-entities, and load-external-dtd at their defaults. An attacker can read local files out of band by submitting XML containing an external entity declaration to an application that unmarshals untrusted documents. Exploitation depends on the JAXP implementation in use, because secure processing alone does not block external entity resolution on every implementation.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

A fix was pushed into the master branch but not yet published.

References

XML External Entity (XXE) Injection vulnerability report

low severity

Improper Validation of Specified Type of Input

  • Vulnerable module: jakarta.validation:jakarta.validation-api
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.4

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › org.hibernate.validator:hibernate-validator@9.1.5.Final › jakarta.validation:jakarta.validation-api@3.1.1
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.4 › org.ligoj.bootstrap:bootstrap-core@5.0.4 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › io.github.vpelikh:swagger-integration-jakarta@3.0.0 › io.github.vpelikh:swagger-core-jakarta@3.0.0 › jakarta.validation:jakarta.validation-api@3.1.1

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the run method of the ProviderSpecificBootstrapImpl class in Validation.java, which passes a caller influenced action to the single argument form of AccessController.doPrivileged, dropping the calling thread's restricted ProtectionDomain from the access control stack. Code running in a restricted domain can execute an arbitrary class's no-arg constructor under the library's broader permissions by passing any Class object to Validation.byProvider through a raw or unchecked cast, since the generic bound is erased and NewProviderInstance.run reaches clazz.newInstance before the cast to ValidationProvider is attempted. Exploitation requires a JVM running with a SecurityManager, a code source for the library granted more permissions than the caller, the ability to run code in process, and a reachable class in a privileged domain whose public no-arg constructor performs a security checked side effect, and the gadget's own ProtectionDomain stays on the stack so a self defined class yields nothing.

Note: Only deployments on JDK releases before 24 are affected. The run helper elevates privilege only when System.getSecurityManager() returns non-null, and JEP 486 permanently disabled the Security Manager in JDK 24.

Remediation

Upgrade jakarta.validation:jakarta.validation-api to version 4.0.0-M1 or higher.

References

Improper Validation of Specified Type of Input vulnerability report