Vulnerabilities |
1 via 2 paths |
|---|---|
Dependencies |
40 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
medium severity
- Module: com.h2database:h2
- Introduced through: com.h2database:h2@2.5.252
Detailed paths
-
Introduced through: openmrs/openmrs-core@openmrs/openmrs-core › com.h2database:h2@2.5.252
Dual license: EPL-1.0, MPL-2.0
medium severity
- Module: org.dbunit:dbunit
- Introduced through: org.dbunit:dbunit@3.5.2
Detailed paths
-
Introduced through: openmrs/openmrs-core@openmrs/openmrs-core › org.dbunit:dbunit@3.5.2
LGPL-2.1 license
low severity
new
- Vulnerable module: org.objenesis:objenesis
- Introduced through: org.mockito:mockito-core@5.24.0 and org.mockito:mockito-junit-jupiter@5.24.0
Detailed paths
-
Introduced through: openmrs/openmrs-core@openmrs/openmrs-core › org.mockito:mockito-core@5.24.0 › org.objenesis:objenesis@3.3
-
Introduced through: openmrs/openmrs-core@openmrs/openmrs-core › org.mockito:mockito-junit-jupiter@5.24.0 › org.mockito:mockito-core@5.24.0 › org.objenesis:objenesis@3.3
Overview
Affected versions of this package are vulnerable to Symbolic Name not Mapping to Correct Object through the getInstantiatorOf process. An attacker can cause objects from one class loader to be substituted into another by exploiting instantiator caching keyed on class name, potentially leading to unexpected behavior, data corruption, or application crashes by introducing wrong-class objects.
Remediation
Upgrade org.objenesis:objenesis to version 3.6 or higher.