Vulnerabilities

 7 via 30 paths

Dependencies

 24

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 7
  • 2
Severity
  • 3
  • 5
  • 1
Status
  • 9
  • 0
  • 0

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: org.assertj:assertj-core
  • Introduced through: org.apache.logging.log4j:log4j-1.2-api@2.17.0, org.apache.logging.log4j:log4j-core@2.17.0 and others

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.assertj:assertj-core@3.20.2
    Remediation: Upgrade to org.apache.logging.log4j:log4j-1.2-api@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.assertj:assertj-core@3.20.2
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.assertj:assertj-core@3.20.2
    Remediation: Upgrade to org.apache.logging.log4j:log4j-jul@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.assertj:assertj-core@3.20.2
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.assertj:assertj-core@3.20.2
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the toXmlDocument function of XmlStringPrettyFormatter. An attacker can read arbitrary local files, perform server-side request forgery, or cause denial of service by providing crafted XML input containing external entities.

Note: This formatter is used by isXmlEqualTo(CharSequence) and xmlPrettyFormat(String) and could be exploited if untrusted XML input is processed by the methods.

Workaround

Replace use of isXmlEqualTo(CharSequence) with XMLUnit.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade org.assertj:assertj-core to version 3.27.7 or higher.

References

XML External Entity (XXE) Injection vulnerability report

high severity

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: org.apache.logging.log4j:log4j-core@2.17.0 and org.apache.logging.log4j:log4j-slf4j-impl@2.17.0

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.25.4.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.25.4.

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the XmlLayout plugin. An attacker can cause log events to be silently lost or malformed by injecting XML 1.0 forbidden characters into log messages or MDC values. This may result in malformed XML output, which can cause downstream log-processing systems to drop affected records or prevent log events from being delivered to their intended destinations.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report

high severity

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: org.apache.logging.log4j:log4j-core@2.17.0 and org.apache.logging.log4j:log4j-slf4j-impl@2.17.0

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.25.4.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.25.4.

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the Log4j1XmlLayout plugin. An attacker can cause log events to be silently lost or downstream log processing systems to drop or fail to index affected records by introducing XML 1.0 forbidden characters into log messages, resulting in malformed XML output that conforming XML parsers reject with a fatal error.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity

Arbitrary Code Execution

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: org.apache.logging.log4j:log4j-core@2.17.0 and org.apache.logging.log4j:log4j-slf4j-impl@2.17.0

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.17.1.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.1.

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Arbitrary Code Execution.
Note: Even though this vulnerability appears to be related to the log4Shell vulnerability, this vulnerability requires an attacker to have access to modify configurations to be exploitable, which is rarely possible.

An attacker with access to modification of logging configuration is able to configure JDBCAppender with a data source referencing a JNDI URI - which can execute malicious code.

In the fixed versions, JDBCAppender is using JndiManager and disables JNDI lookups by default (via log4j2.enableJndiJdbc=false).

Alternative Remediation

If you have reason to believe your application may be vulnerable and upgrading is not an option, you can either:

  • Disable/remove JDBCAppender
  • If JDBCAppender is used, make sure that it is not configured to use any protocol other than Java

Remediation

Upgrade org.apache.logging.log4j:log4j-core to version 2.3.2, 2.12.4, 2.17.1 or higher.

References

Arbitrary Code Execution vulnerability report

medium severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: org.apache.logging.log4j:log4j-core@2.17.0 and org.apache.logging.log4j:log4j-slf4j-impl@2.17.0

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.25.3.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.25.3.

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component. An attacker can intercept or redirect log traffic by performing a man-in-the-middle attack if they are able to intercept or redirect network traffic between the client and the log receiver and can present a server certificate issued by a certification authority trusted by the configured trust store or the default Java trust store.

Workaround

This vulnerability can be mitigated by configuring the SocketAppender to use a private or restricted trust root to limit the set of trusted certificates.

Remediation

Upgrade org.apache.logging.log4j:log4j-core to version 2.25.3 or higher.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

medium severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: org.apache.logging.log4j:log4j-core@2.17.0 and org.apache.logging.log4j:log4j-slf4j-impl@2.17.0

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.25.4.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.25.4.

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component when configured through the verifyHostName attribute of the <Ssl> element. An attacker can intercept and manipulate network traffic by presenting a certificate issued by a trusted certificate authority to the appender's configured trust store, or the default Java trust store if none is configured. This is only exploitable if an SMTP, Socket, or Syslog appender is in use and TLS is configured via a nested element.

Note:

This issue is due to incomplete fix for CVE-2025-68161.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: org.apache.logging.log4j:log4j-jul@2.17.0, org.apache.logging.log4j:log4j-1.2-api@2.17.0 and others

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12

EPL-1.0 license

EPL-1.0 license vulnerability report

medium severity

LGPL-3.0 license

  • Module: org.codehaus.sonar:sonar-maven3-plugin
  • Introduced through: org.codehaus.sonar:sonar-maven3-plugin@5.1

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.codehaus.sonar:sonar-maven3-plugin@5.1

LGPL-3.0 license

LGPL-3.0 license vulnerability report

low severity

Information Exposure

  • Vulnerable module: junit:junit
  • Introduced through: org.apache.logging.log4j:log4j-jul@2.17.0, org.apache.logging.log4j:log4j-1.2-api@2.17.0 and others

Detailed paths

  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-jul@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-1.2-api@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-1.2-api@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-jul@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-1.2-api@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-1.2-api@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-core@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-jul@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-jul@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.jupiter:junit-jupiter-migrationsupport@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.
  • Introduced through: mysql-time-machine/replicator@mysql-time-machine/replicator › org.apache.logging.log4j:log4j-slf4j-impl@2.17.0 › org.apache.logging.log4j:log4j-core@2.17.0 › org.apache.logging.log4j:log4j-api@2.17.0 › org.junit.vintage:junit-vintage-engine@5.7.2 › junit:junit@4.12
    Remediation: Upgrade to org.apache.logging.log4j:log4j-slf4j-impl@2.17.0.

Overview

junit:junit is an unit testing framework for Java

Affected versions of this package are vulnerable to Information Exposure. The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

Note: This vulnerability does not allow other users to overwrite the contents of these directories or files. This only affects Unix like systems.

Remediation

Upgrade junit:junit to version 4.13.1 or higher.

References

Information Exposure vulnerability report