Vulnerabilities

 6 via 36 paths

Dependencies

 40

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 6
  • 1
Severity
  • 2
  • 2
  • 2
  • 1
Status
  • 7
  • 0
  • 0

critical severity

Improper Input Validation

  • Vulnerable module: org.codehaus.jackson:jackson-mapper-asl
  • Introduced through: org.glassfish.jersey.media:jersey-media-json-jackson@2.6

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-jaxrs@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-xc@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13

Overview

org.codehaus.jackson:jackson-mapper-asl is a high-performance data binding package built on Jackson JSON processor.

Affected versions of this package are vulnerable to Improper Input Validation which results in several instances of deserialization of untrusted data. This issue is parallel to vulnerabilities reported and fixed in jackson-databind (CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086). Although no fix is available for codehaus, this vulnerability can be remediated by using a fixed version of jackson-databind.

Remediation

There is no fixed version for org.codehaus.jackson:jackson-mapper-asl.

References

Improper Input Validation vulnerability report

critical severity

Race Condition

  • Vulnerable module: org.glassfish.jersey.core:jersey-client
  • Introduced through: org.glassfish.jersey.core:jersey-server@2.6, org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 and others

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.46.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-client@2.6
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.46.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.46.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6
    Remediation: Upgrade to org.glassfish.jersey.containers:jersey-container-servlet@2.46.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.test-framework:jersey-test-framework-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.46.

Overview

Affected versions of this package are vulnerable to Race Condition in the HttpUrlConnector class, during initialization of SSL sockets. An attacker can cause the application to ignore custom SSL settings, including mutual authentication, custom key and trust stores, and other security configurations, by initiating concurrent HTTPS connection requests. This may lead to SSLHandshakeException errors in normal situations, and unauthorized trust in insecure servers under specific conditions.

Remediation

Upgrade org.glassfish.jersey.core:jersey-client to version 2.46, 3.0.17, 3.1.10, 4.0.0-M2 or higher.

References

Race Condition vulnerability report

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: org.codehaus.jackson:jackson-mapper-asl
  • Introduced through: org.glassfish.jersey.media:jersey-media-json-jackson@2.6

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-jaxrs@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-xc@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13

Overview

org.codehaus.jackson:jackson-mapper-asl is a high-performance data binding package built on Jackson JSON processor.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. via the DOMDeserializer.class file and its inner classes (DocumentDeserializer.class and NodeDeserializer.class) that uses the _parserFactory instance without restricting it from processing external XML entities when parsing user input.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

There is no fixed version for org.codehaus.jackson:jackson-mapper-asl.

For org.codehaus.jackson:jackson-all releases supporting jackson-mapper-asl. As a workaround, for 1.9.X release, the javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING setting can be enabled. For 2.x releases, the "javax.xml.stream.isSupportingExternalEntities setting can be set to FALSE.

References

XML External Entity (XXE) Injection vulnerability report

high severity

Dual license: CDDL-1.0, GPL-2.0

  • Module: org.glassfish.jersey.containers:jersey-container-servlet-core
  • Introduced through: org.glassfish.jersey.containers:jersey-container-servlet@2.6

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6

Dual license: CDDL-1.0, GPL-2.0

Dual license: CDDL-1.0, GPL-2.0 vulnerability report

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: org.codehaus.jackson:jackson-mapper-asl
  • Introduced through: org.glassfish.jersey.media:jersey-media-json-jackson@2.6

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-jaxrs@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.codehaus.jackson:jackson-xc@1.9.13 › org.codehaus.jackson:jackson-mapper-asl@1.9.13

Overview

org.codehaus.jackson:jackson-mapper-asl is a high-performance data binding package built on Jackson JSON processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _findDeserializer() method of TypeDeserializerBase, which caches every unknown type ID as a distinct key in the _deserializers map even when all of them resolve to the same defaultImpl fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests.

Remediation

There is no fixed version for org.codehaus.jackson:jackson-mapper-asl.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Deserialization of Untrusted Data

  • Vulnerable module: com.google.code.gson:gson
  • Introduced through: com.google.code.gson:gson@2.2.4

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › com.google.code.gson:gson@2.2.4
    Remediation: Upgrade to com.google.code.gson:gson@2.8.9.

Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may allow a denial of service attack if combined with another exploit.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.google.code.gson:gson to version 2.8.9 or higher.

References

Deserialization of Untrusted Data vulnerability report

low severity

Information Exposure

  • Vulnerable module: junit:junit
  • Introduced through: junit:junit@4.11, org.glassfish.jersey.core:jersey-common@2.6 and others

Detailed paths

  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › junit:junit@4.11
    Remediation: Upgrade to junit:junit@4.13.1.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-common@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.media:jersey-media-json-jackson@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.media:jersey-media-json-jackson@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.containers:jersey-container-servlet@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.test-framework:jersey-test-framework-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.containers:jersey-container-servlet@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.test-framework:jersey-test-framework-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.containers:jersey-container-servlet@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.test-framework:jersey-test-framework-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.containers:jersey-container-servlet@2.6 › org.glassfish.jersey.containers:jersey-container-servlet-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.containers:jersey-container-servlet@2.26.
  • Introduced through: mbettadp/anagramfinder@mbettadp/anagramfinder › org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.6 › org.glassfish.jersey.test-framework:jersey-test-framework-core@2.6 › org.glassfish.jersey.core:jersey-server@2.6 › org.glassfish.jersey.core:jersey-client@2.6 › org.glassfish.jersey.core:jersey-common@2.6 › org.glassfish.hk2:hk2-locator@4.0.3 › junit:junit@4.11
    Remediation: Upgrade to org.glassfish.jersey.test-framework.providers:jersey-test-framework-provider-inmemory@2.26.

Overview

junit:junit is an unit testing framework for Java

Affected versions of this package are vulnerable to Information Exposure. The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

Note: This vulnerability does not allow other users to overwrite the contents of these directories or files. This only affects Unix like systems.

Remediation

Upgrade junit:junit to version 4.13.1 or higher.

References

Information Exposure vulnerability report