Vulnerabilities

 2 via 2 paths

Dependencies

 18

Source

 GitHub

Commit

 b776e1d7

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 2
  • 2
Severity
  • 1
  • 2
  • 1
Status
  • 4
  • 0
  • 0

high severity

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • Vulnerable module: commons-beanutils:commons-beanutils
  • Introduced through: com.puppycrawl.tools:checkstyle@9.3

Detailed paths

  • Introduced through: stringbean/sbt-checkstyle-plugin@stringbean/sbt-checkstyle-plugin#b776e1d7241da8372096e6ff0a075df04fc40cd2 › com.puppycrawl.tools:checkstyle@9.3 › commons-beanutils:commons-beanutils@1.9.4
    Remediation: Upgrade to com.puppycrawl.tools:checkstyle@10.25.0.

Overview

commons-beanutils:commons-beanutils is a provides an easy-to-use but flexible wrapper around reflection and introspection.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via the getProperty and getNestedProperty methods of the PropertyUtilsBean class. An attacker can execute arbitrary code by accessing the declaredClass property of Java enum objects, which allows access to the ClassLoader.

Note:

The BeanIntrospector class that can mitigate this vulnerability was added in version 1.9.2 but its usage was not enabled by default.

Remediation

Upgrade commons-beanutils:commons-beanutils to version 1.11.0 or higher.

References

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability report

medium severity

LGPL-2.1 license

  • Module: com.puppycrawl.tools:checkstyle
  • Introduced through: com.puppycrawl.tools:checkstyle@9.3

Detailed paths

  • Introduced through: stringbean/sbt-checkstyle-plugin@stringbean/sbt-checkstyle-plugin#b776e1d7241da8372096e6ff0a075df04fc40cd2 › com.puppycrawl.tools:checkstyle@9.3

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

MPL-2.0 license

  • Module: net.sf.saxon:Saxon-HE
  • Introduced through: com.puppycrawl.tools:checkstyle@9.3

Detailed paths

  • Introduced through: stringbean/sbt-checkstyle-plugin@stringbean/sbt-checkstyle-plugin#b776e1d7241da8372096e6ff0a075df04fc40cd2 › com.puppycrawl.tools:checkstyle@9.3 › net.sf.saxon:Saxon-HE@10.6

MPL-2.0 license

MPL-2.0 license vulnerability report

low severity

Creation of Temporary File in Directory with Insecure Permissions

  • Vulnerable module: com.google.guava:guava
  • Introduced through: com.puppycrawl.tools:checkstyle@9.3

Detailed paths

  • Introduced through: stringbean/sbt-checkstyle-plugin@stringbean/sbt-checkstyle-plugin#b776e1d7241da8372096e6ff0a075df04fc40cd2 › com.puppycrawl.tools:checkstyle@9.3 › com.google.guava:guava@31.0.1-jre
    Remediation: Upgrade to com.puppycrawl.tools:checkstyle@10.12.1.

Overview

com.google.guava:guava is a set of core libraries that includes new collection types (such as multimap and multiset,immutable collections, a graph library, functional types, an in-memory cache and more.

Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the use of Java's default temporary directory for file creation in FileBackedOutputStream. Other users and apps on the machine with access to the default Java temporary directory can access the files created by this class. This more fully addresses the underlying issue described in CVE-2020-8908, by deprecating the permissive temp file creation behavior.

NOTE: Even though the security vulnerability is fixed in version 32.0.0, the maintainers recommend using version 32.0.1, as version 32.0.0 breaks some functionality under Windows.

Remediation

Upgrade com.google.guava:guava to version 32.0.0-android, 32.0.0-jre or higher.

References

Creation of Temporary File in Directory with Insecure Permissions vulnerability report