Vulnerabilities	4 via 43 paths
Dependencies	47
Source	GitHub
Commit	783e474c

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications

Severity

Critical
High
2
Medium
1
Low
1

Status

Open
4
Patched
0
Ignored
0

high severity

Open Redirect

Vulnerable module: org.springframework:spring-web
Introduced through: com.marklogic:ml-app-deployer@4.7.0

Detailed paths

Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › org.springframework:spring-web@5.3.31

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Open Redirect when UriComponentsBuilder parses an externally provided URL, and the application subsequently uses that URL. If it contains hierarchical components such as path, query, and fragment it may evade validation.

Remediation

Upgrade org.springframework:spring-web to version 5.3.32, 6.0.17, 6.1.4 or higher.

References

Open Redirect vulnerability report

high severity

Open Redirect

Vulnerable module: org.springframework:spring-web
Introduced through: com.marklogic:ml-app-deployer@4.7.0

Detailed paths

Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › org.springframework:spring-web@5.3.31

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL.

Note: This is the same as CVE-2024-22243, but with different input.

Remediation

Upgrade org.springframework:spring-web to version 5.3.33, 6.0.18, 6.1.5 or higher.

References

Open Redirect vulnerability report

medium severity

Open Redirect

Vulnerable module: org.springframework:spring-web
Introduced through: com.marklogic:ml-app-deployer@4.7.0

Detailed paths

Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › org.springframework:spring-web@5.3.31

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Open Redirect when UriComponentsBuilder is used to parse an externally provided URL and perform validation checks on the host of the parsed URL.

Note: This is the same as CVE-2024-22259 and CVE-2024-22243, but with different input.

Remediation

Upgrade org.springframework:spring-web to version 5.3.34, 6.0.19, 6.1.6 or higher.

References

Spring Advisory

Open Redirect vulnerability report

low severity

Information Exposure

Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
Introduced through: com.marklogic:ml-app-deployer@4.7.0 and com.marklogic:marklogic-data-movement-components@2.7.0

Detailed paths

Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:marklogic-data-movement-components@2.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › com.squareup.okhttp3:logging-interceptor@4.11.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: marklogic-community/ml-gradle@marklogic-community/ml-gradle#783e474ccb42098348d7aca7b4959c310d5c050d › com.marklogic:ml-app-deployer@4.7.0 › com.marklogic:ml-javaclient-util@4.7.0 › com.marklogic:marklogic-client-api@6.3.0 › io.github.rburgst:okhttp-digest@2.7 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.

Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

PoC by JLLeitschuh

package org.jlleitschuh.sandbox

import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files

class KotlinTempDirectoryPermissionCheck {
    @Test
    fun `kotlin check default directory permissions`() {
        val dir = createTempDir()
        runLS(dir.parentFile, dir) // Prints drwxr-xr-x
    }

    @Test
    fun `Files check default directory permissions`() {
        val dir = Files.createTempDirectory("random-directory")
        runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
    }

    @Test
    fun `kotlin check default file permissions`() {
        val file = createTempFile()
        runLS(file.parentFile, file) // Prints -rw-r--r--
    }

    @Test
    fun `Files check default file permissions`() {
        val file = Files.createTempFile("random-file", ".txt")
        runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
    }

    private fun runLS(file: File, lookingFor: File) {
        val processBuilder = ProcessBuilder()
        processBuilder.command("ls", "-l", file.absolutePath)
        try {
            val process = processBuilder.start()
            val output = StringBuilder()
            val reader = BufferedReader(
                InputStreamReader(process.inputStream)
            )
            reader.lines().forEach { line ->
                if (line.contains("total")) {
                    output.append(line).append('\n')
                }
                if (line.contains(lookingFor.name)) {
                    output.append(line).append('\n')
                }
            }
            val exitVal = process.waitFor()
            if (exitVal == 0) {
                println("Success!")
                println(output)
            } else {
                //abnormal...
            }
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: InterruptedException) {
            e.printStackTrace()
        }
    }
}

Remediation

There is no fixed version for org.jetbrains.kotlin:kotlin-stdlib.

References

Information Exposure vulnerability report

Vulnerabilities

Dependencies

Source

Commit

Find, fix and prevent vulnerabilities in your code.

high severity

Open Redirect

Detailed paths

Overview

Remediation

References

high severity

Open Redirect

Detailed paths

Overview

Remediation

References

medium severity

Open Redirect

Detailed paths

Overview

Remediation

References

low severity

Information Exposure

Detailed paths

Overview

PoC by JLLeitschuh

Remediation

References