Vulnerabilities

 7 via 8 paths

Dependencies

 31

Source

 GitHub

Commit

 75a17f1f

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 7
  • 3
Severity
  • 3
  • 7
Status
  • 10
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: org.apache.commons:commons-lang3
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.commons:commons-lang3@3.12.0
    Remediation: Upgrade to dev.openfeature:sdk@1.18.0.
  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.commons:commons-text@1.10.0 › org.apache.commons:commons-lang3@3.12.0
    Remediation: Upgrade to dev.openfeature:sdk@1.18.0.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

Upgrade org.apache.commons:commons-lang3 to version 3.18.0 or higher.

References

Uncontrolled Recursion vulnerability report

high severity
new

Denial of Service (DoS)

  • Vulnerable module: org.apache.httpcomponents.core5:httpcore5-h2
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › net.sf.saxon:Saxon-HE@11.4 › org.xmlresolver:xmlresolver@4.4.3 › org.apache.httpcomponents.client5:httpclient5@5.1.3 › org.apache.httpcomponents.core5:httpcore5-h2@5.1.3

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to incorrect stream accounting in the handling of server-sent stream resets. An attacker can cause excessive server resource consumption by rapidly opening streams and triggering resets using malformed frames or flow control errors, resulting in the server processing an unbounded number of concurrent streams on a single connection.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.httpcomponents.core5:httpcore5-h2 to version 5.3.5 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: org.apache.bcel:bcel
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.bcel:bcel@6.5.0
    Remediation: Upgrade to dev.openfeature:sdk@1.7.0.

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write where a number of APIs can be used to produce arbitrary bytecode. This can be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected.

Remediation

Upgrade org.apache.bcel:bcel to version 6.6.0 or higher.

References

Out-of-bounds Write vulnerability report

medium severity
new

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.logging.log4j:log4j-core@2.19.0

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the XmlLayout plugin. An attacker can cause log events to be silently lost or malformed by injecting XML 1.0 forbidden characters into log messages or MDC values. This may result in malformed XML output, which can cause downstream log-processing systems to drop affected records or prevent log events from being delivered to their intended destinations.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity
new

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.logging.log4j:log4j-core@2.19.0

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the Log4j1XmlLayout plugin. An attacker can cause log events to be silently lost or downstream log processing systems to drop or fail to index affected records by introducing XML 1.0 forbidden characters into log messages, resulting in malformed XML output that conforming XML parsers reject with a fatal error.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.logging.log4j:log4j-core@2.19.0

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component. An attacker can intercept or redirect log traffic by performing a man-in-the-middle attack if they are able to intercept or redirect network traffic between the client and the log receiver and can present a server certificate issued by a certification authority trusted by the configured trust store or the default Java trust store.

Workaround

This vulnerability can be mitigated by configuring the SocketAppender to use a private or restricted trust root to limit the set of trusted certificates.

Remediation

Upgrade org.apache.logging.log4j:log4j-core to version 2.25.3 or higher.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

medium severity
new

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: org.apache.logging.log4j:log4j-core
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › org.apache.logging.log4j:log4j-core@2.19.0

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component when configured through the verifyHostName attribute of the <Ssl> element. An attacker can intercept and manipulate network traffic by presenting a certificate issued by a trusted certificate authority to the appender's configured trust store, or the default Java trust store if none is configured. This is only exploitable if an SMTP, Socket, or Syslog appender is in use and TLS is configured via a nested element.

Note:

This issue is due to incomplete fix for CVE-2025-68161.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

medium severity

LGPL-2.1 license

  • Module: com.github.spotbugs:spotbugs
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

LGPL-2.1 license

  • Module: com.github.spotbugs:spotbugs-annotations
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › com.github.spotbugs:spotbugs-annotations@4.7.3

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

MPL-2.0 license

  • Module: net.sf.saxon:Saxon-HE
  • Introduced through: dev.openfeature:sdk@1.0.0

Detailed paths

  • Introduced through: rollout/cloudbees-openfeature-provider-java@rollout/cloudbees-openfeature-provider-java#75a17f1f9c64b98829780c34cb032563443f3eed › dev.openfeature:sdk@1.0.0 › com.github.spotbugs:spotbugs@4.7.3 › net.sf.saxon:Saxon-HE@11.4

MPL-2.0 license

MPL-2.0 license vulnerability report