Vulnerabilities

 3 via 35 paths

Dependencies

 114

Source

 GitHub

Commit

 a477fc74

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 3
  • 6
Severity
  • 2
  • 6
  • 1
Status
  • 9
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: org.apache.commons:commons-lang3
  • Introduced through: org.springdoc:springdoc-openapi-starter-webmvc-ui@2.8.15

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springdoc:springdoc-openapi-starter-webmvc-ui@2.8.15 › org.springdoc:springdoc-openapi-starter-webmvc-api@2.8.15 › org.springdoc:springdoc-openapi-starter-common@2.8.15 › io.swagger.core.v3:swagger-core-jakarta@2.2.41 › org.apache.commons:commons-lang3@3.17.0
    Remediation: Upgrade to org.springdoc:springdoc-openapi-starter-webmvc-ui@2.8.15.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

Upgrade org.apache.commons:commons-lang3 to version 3.18.0 or higher.

References

Uncontrolled Recursion vulnerability report

high severity
new

Incorrect Authorization

  • Vulnerable module: org.apache.tomcat.embed:tomcat-embed-core
  • Introduced through: org.springframework.boot:spring-boot-starter-web@3.5.10

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter-tomcat@3.5.10 › org.apache.tomcat.embed:tomcat-embed-core@10.1.50
    Remediation: Upgrade to org.springframework.boot:spring-boot-starter-web@3.5.11.
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter-tomcat@3.5.10 › org.apache.tomcat.embed:tomcat-embed-websocket@10.1.50 › org.apache.tomcat.embed:tomcat-embed-core@10.1.50
    Remediation: Upgrade to org.springframework.boot:spring-boot-starter-web@3.5.11.

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be bypassed.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.114, 10.1.52, 11.0.18 or higher.

References

Incorrect Authorization vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-classic
  • Introduced through: org.springframework.boot:spring-boot-starter-validation@3.5.10, org.springframework.boot:spring-boot-starter-actuator@3.5.10 and others

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-validation@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-actuator@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-aop@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-cache@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.springframework.boot:spring-boot-starter-jdbc@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter-json@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springdoc:springdoc-openapi-starter-webmvc-ui@2.8.15 › org.springdoc:springdoc-openapi-starter-webmvc-api@2.8.15 › org.springdoc:springdoc-openapi-starter-common@2.8.15 › org.springframework.boot:spring-boot-starter-validation@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

medium severity

Dual license: EPL-1.0, LGPL-2.1

  • Module: ch.qos.logback:logback-core
  • Introduced through: org.springframework.boot:spring-boot-starter-validation@3.5.10, org.springframework.boot:spring-boot-starter-actuator@3.5.10 and others

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-validation@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-actuator@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-aop@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-cache@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.springframework.boot:spring-boot-starter-jdbc@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-web@3.5.10 › org.springframework.boot:spring-boot-starter-json@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springdoc:springdoc-openapi-starter-webmvc-ui@2.8.15 › org.springdoc:springdoc-openapi-starter-webmvc-api@2.8.15 › org.springdoc:springdoc-openapi-starter-common@2.8.15 › org.springframework.boot:spring-boot-starter-validation@3.5.10 › org.springframework.boot:spring-boot-starter@3.5.10 › org.springframework.boot:spring-boot-starter-logging@3.5.10 › ch.qos.logback:logback-classic@1.5.25 › ch.qos.logback:logback-core@1.5.25

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1 vulnerability report

medium severity

LGPL-2.0 license

  • Module: com.google.code.findbugs:annotations
  • Introduced through: com.google.code.findbugs:annotations@3.0.1u2

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › com.google.code.findbugs:annotations@3.0.1u2

LGPL-2.0 license

LGPL-2.0 license vulnerability report

medium severity

Dual license: EPL-1.0, MPL-2.0

  • Module: com.h2database:h2
  • Introduced through: com.h2database:h2@2.3.232

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › com.h2database:h2@2.3.232

Dual license: EPL-1.0, MPL-2.0

Dual license: EPL-1.0, MPL-2.0 vulnerability report

medium severity

LGPL-2.1 license

  • Module: org.hibernate.common:hibernate-commons-annotations
  • Introduced through: org.springframework.boot:spring-boot-starter-data-jpa@3.5.10

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.hibernate.orm:hibernate-core@6.6.41.Final › org.hibernate.common:hibernate-commons-annotations@7.0.3.Final

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

LGPL-2.1 license

  • Module: org.hibernate.orm:hibernate-core
  • Introduced through: org.springframework.boot:spring-boot-starter-data-jpa@3.5.10

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › org.springframework.boot:spring-boot-starter-data-jpa@3.5.10 › org.hibernate.orm:hibernate-core@6.6.41.Final

LGPL-2.1 license

LGPL-2.1 license vulnerability report

low severity

Information Exposure

  • Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
  • Introduced through: io.github.resilience4j:resilience4j-spring-boot2@2.3.0

Detailed paths

  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-consumer@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-consumer@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-bulkhead@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-circuitbreaker@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-ratelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-retry@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0
  • Introduced through: mirogaudi/product-catalog-service@mirogaudi/product-catalog-service#a477fc7411eb42fb47f5bb2f6a614a65ee0d123a › io.github.resilience4j:resilience4j-spring-boot2@2.3.0 › io.github.resilience4j:resilience4j-spring@2.3.0 › io.github.resilience4j:resilience4j-framework-common@2.3.0 › io.github.resilience4j:resilience4j-micrometer@2.3.0 › io.github.resilience4j:resilience4j-timelimiter@2.3.0 › io.github.resilience4j:resilience4j-core@2.3.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.9.0 › org.jetbrains.kotlin:kotlin-stdlib@1.9.0

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.

Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

PoC by JLLeitschuh

package org.jlleitschuh.sandbox

import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files

class KotlinTempDirectoryPermissionCheck {
    @Test
    fun `kotlin check default directory permissions`() {
        val dir = createTempDir()
        runLS(dir.parentFile, dir) // Prints drwxr-xr-x
    }

    @Test
    fun `Files check default directory permissions`() {
        val dir = Files.createTempDirectory("random-directory")
        runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
    }

    @Test
    fun `kotlin check default file permissions`() {
        val file = createTempFile()
        runLS(file.parentFile, file) // Prints -rw-r--r--
    }

    @Test
    fun `Files check default file permissions`() {
        val file = Files.createTempFile("random-file", ".txt")
        runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
    }

    private fun runLS(file: File, lookingFor: File) {
        val processBuilder = ProcessBuilder()
        processBuilder.command("ls", "-l", file.absolutePath)
        try {
            val process = processBuilder.start()
            val output = StringBuilder()
            val reader = BufferedReader(
                InputStreamReader(process.inputStream)
            )
            reader.lines().forEach { line ->
                if (line.contains("total")) {
                    output.append(line).append('\n')
                }
                if (line.contains(lookingFor.name)) {
                    output.append(line).append('\n')
                }
            }
            val exitVal = process.waitFor()
            if (exitVal == 0) {
                println("Success!")
                println(output)
            } else {
                //abnormal...
            }
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: InterruptedException) {
            e.printStackTrace()
        }
    }
}

Remediation

Upgrade org.jetbrains.kotlin:kotlin-stdlib to version 2.1.0 or higher.

References

Information Exposure vulnerability report