Vulnerabilities	14 via 195 paths
Dependencies	161
Source	GitHub
Commit	e74951e1

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications

Issue type

Vulnerabilities
14
License issues
1

Severity

Critical
1
High
2
Medium
6
Low
6

Status

Open
15
Patched
0
Ignored
0

critical severity

Deserialization of Untrusted Data

Vulnerable module: org.slf4j:slf4j-ext
Introduced through: io.swagger:swagger-parser@1.0.36 and io.swagger.parser.v3:swagger-parser@2.0.2

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › org.slf4j:slf4j-ext@1.6.3

Remediation: Upgrade to io.swagger:swagger-parser@1.0.46.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › org.slf4j:slf4j-ext@1.6.3

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › org.slf4j:slf4j-ext@1.6.3

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › org.slf4j:slf4j-ext@1.6.3

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.14.

…and 1 more

Overview

org.slf4j:slf4j-ext is a simple facade or abstraction for various logging frameworks allowing the end user to plug in the desired logging framework at deployment time.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A remote attacker may be able to bypass intended access restrictions via crafted data.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Apache Blog

The vulnerability, also know as Mad Gadget

Mad Gadget is one of the most pernicious vulnerabilities we’ve seen. By merely existing on the Java classpath, seven “gadget” classes in Apache Commons Collections (versions 3.0, 3.1, 3.2, 3.2.1, and 4.0) make object deserialization for the entire JVM process Turing complete with an exec function. Since many business applications use object deserialization to send messages across the network, it would be like hiring a bank teller who was trained to hand over all the money in the vault if asked to do so politely, and then entrusting that teller with the key. The only thing that would keep a bank safe in such a circumstance is that most people wouldn’t consider asking such a question.

Google

Remediation

Upgrade org.slf4j:slf4j-ext to version 1.7.26, 1.8.0-beta2 or higher.

References

Deserialization of Untrusted Data vulnerability report

high severity

XML External Entity (XXE) Injection

Vulnerable module: org.mozilla:rhino
Introduced through: io.swagger.parser.v3:swagger-parser@2.0.2

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › org.mozilla:rhino@1.7R4

Overview

org.mozilla:rhino is a Rhino is an open-source implementation of JavaScript written entirely in Java. It is typically embedded into Java applications to provide scripting to end users.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. The function toXml allows usage of external entities when parsing an XML document.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade org.mozilla:rhino to version 1.7.12 or higher.

References

XML External Entity (XXE) Injection vulnerability report

high severity

Infinite loop

Vulnerable module: org.bouncycastle:bcprov-jdk18on
Introduced through: io.github.bonigarcia:webdrivermanager@5.8.0

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcutil-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76

Overview

Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.78 or higher.

References

Infinite loop vulnerability report

medium severity

Uncontrolled Resource Consumption

Vulnerable module: commons-io:commons-io
Introduced through: io.swagger:swagger-parser@1.0.36, io.swagger.parser.v3:swagger-parser@2.0.2 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger:swagger-parser@1.0.69.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › org.apache.commons:commons-compress@1.26.1 › commons-io:commons-io@2.4

Remediation: Upgrade to io.github.bonigarcia:webdrivermanager@5.8.0.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger:swagger-parser@1.0.36.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › commons-io:commons-io@2.4
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › io.swagger.core.v3:swagger-core@2.0.3 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.20.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.apache.commons:commons-compress@1.26.1 › commons-io:commons-io@2.4
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › io.swagger.core.v3:swagger-core@2.0.3 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.20.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

…and 12 more

Overview

commons-io:commons-io is a The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the XmlStreamReader class. An attacker can cause the application to consume excessive CPU resources by sending specially crafted XML content.

Remediation

Upgrade commons-io:commons-io to version 2.14.0 or higher.

References

Uncontrolled Resource Consumption vulnerability report

medium severity

Deserialization of Untrusted Data

Vulnerable module: com.google.guava:guava
Introduced through: org.reflections:reflections@0.9.11, io.swagger:swagger-parser@1.0.36 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.reflections:reflections@0.9.11 › com.google.guava:guava@20.0

Remediation: Upgrade to org.reflections:reflections@0.9.12.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger:swagger-parser@1.0.42.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v121@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v122@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v123@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-ie-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-safari-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.9.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.9.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.fge:json-patch@1.6 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.9.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:uri-template@0.9 › com.google.guava:guava@20.0

…and 21 more

Overview

com.google.guava:guava is a set of core libraries that includes new collection types (such as multimap and multiset,immutable collections, a graph library, functional types, an in-memory cache and more.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. During deserialization, two Guava classes accept a caller-specified size parameter and eagerly allocate an array of that size:

AtomicDoubleArray (when serialized with Java serialization)
CompoundOrdering (when serialized with GWT serialization)

An attacker may be able to send a specially crafted request which with then cause the server to allocate all it's memory, without validation whether the data size is reasonable.

Details

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.google.guava:guava to version 24.1.1, 24.1.1-jre or higher.

References

Deserialization of Untrusted Data vulnerability report

medium severity

Observable Discrepancy

Vulnerable module: org.bouncycastle:bcprov-jdk18on
Introduced through: io.github.bonigarcia:webdrivermanager@5.8.0

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcutil-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76

Overview

Affected versions of this package are vulnerable to Observable Discrepancy due to the timing difference between exceptions thrown when processing RSA key exchange handshakes, AKA Marvin.

Note: The implemented fix mitigates the leakage of data via the PKCS#1 interface, but does not fully alleviate the side-channel as it allows cases in which the padding check fails but the handshake succeeds.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.78 or higher.

References

Observable Discrepancy vulnerability report

medium severity

Directory Traversal

Vulnerable module: commons-io:commons-io
Introduced through: io.swagger:swagger-parser@1.0.36, io.swagger.parser.v3:swagger-parser@2.0.2 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger:swagger-parser@1.0.57.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.28.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › org.apache.commons:commons-compress@1.26.1 › commons-io:commons-io@2.4

Remediation: Upgrade to io.github.bonigarcia:webdrivermanager@5.8.0.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.28.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger:swagger-parser@1.0.36.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › commons-io:commons-io@2.4

Remediation: Upgrade to io.github.bonigarcia:webdrivermanager@5.8.0.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › io.swagger.core.v3:swagger-core@2.0.3 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.28.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.30.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.apache.commons:commons-compress@1.26.1 › commons-io:commons-io@2.4
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › io.swagger.core.v3:swagger-core@2.0.3 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › commons-io:commons-io@2.4

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.30.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › commons-io:commons-io@2.4

…and 12 more

Overview

commons-io:commons-io is a The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Affected versions of this package are vulnerable to Directory Traversal via calling the method FileNameUtils.normalize using an improper string like //../foo or \\..\foo, which may allow access to files in the parent directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade commons-io:commons-io to version 2.7 or higher.

References

Directory Traversal vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: org.bouncycastle:bcprov-jdk18on
Introduced through: io.github.bonigarcia:webdrivermanager@5.8.0

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › org.bouncycastle:bcpkix-jdk18on@1.76 › org.bouncycastle:bcutil-jdk18on@1.76 › org.bouncycastle:bcprov-jdk18on@1.76

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the solveQuadraticEquation() function used for certificate verification in ECCurve.java. Passing a large f2m parameter can cause excessive CPU consumption.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.78 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

new

MPL-2.0 license

Module: org.mozilla:rhino
Introduced through: io.swagger.parser.v3:swagger-parser@2.0.2

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › org.mozilla:rhino@1.7R4

MPL-2.0 license

MPL-2.0 license vulnerability report

low severity

Creation of Temporary File in Directory with Insecure Permissions

Vulnerable module: com.google.guava:guava
Introduced through: org.reflections:reflections@0.9.11, io.swagger:swagger-parser@1.0.36 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.reflections:reflections@0.9.11 › com.google.guava:guava@20.0

Remediation: Upgrade to org.reflections:reflections@0.9.12.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger:swagger-parser@1.0.68.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v121@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v122@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v123@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-ie-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-safari-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.fge:json-patch@1.6 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.17.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:uri-template@0.9 › com.google.guava:guava@20.0

…and 21 more

Overview

Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the use of Java's default temporary directory for file creation in FileBackedOutputStream. Other users and apps on the machine with access to the default Java temporary directory can access the files created by this class. This more fully addresses the underlying issue described in CVE-2020-8908, by deprecating the permissive temp file creation behavior.

NOTE: Even though the security vulnerability is fixed in version 32.0.0, the maintainers recommend using version 32.0.1, as version 32.0.0 breaks some functionality under Windows.

Remediation

Upgrade com.google.guava:guava to version 32.0.0-android, 32.0.0-jre or higher.

References

Creation of Temporary File in Directory with Insecure Permissions vulnerability report

low severity

Information Disclosure

Vulnerable module: com.google.guava:guava
Introduced through: org.reflections:reflections@0.9.11, io.swagger:swagger-parser@1.0.36 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.reflections:reflections@0.9.11 › com.google.guava:guava@20.0

Remediation: Upgrade to org.reflections:reflections@0.9.12.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger:swagger-parser@1.0.57.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.github.bonigarcia:webdrivermanager@5.8.0 › com.github.docker-java:docker-java@3.3.6 › com.github.docker-java:docker-java-core@3.3.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v121@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v122@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v123@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-ie-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-safari-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-support@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.30.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.30.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-chrome-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-edge-driver@4.19.1 › org.seleniumhq.selenium:selenium-chromium-driver@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.seleniumhq.selenium:selenium-java@4.19.1 › org.seleniumhq.selenium:selenium-firefox-driver@4.19.1 › org.seleniumhq.selenium:selenium-devtools-v85@4.19.1 › org.seleniumhq.selenium:selenium-remote-driver@4.19.1 › com.google.guava:guava@20.0

Remediation: Upgrade to org.seleniumhq.selenium:selenium-java@4.19.1.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.fge:json-patch@1.6 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › io.swagger:swagger-parser@1.0.36 › io.swagger:swagger-core@1.5.20 › com.google.guava:guava@20.0

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.0.30.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:jackson-coreutils@1.6 › com.google.guava:guava@20.0
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger:swagger-compat-spec-parser@1.0.37 › com.github.java-json-tools:json-schema-validator@2.2.8 › com.github.java-json-tools:json-schema-core@1.2.8 › com.github.fge:uri-template@0.9 › com.google.guava:guava@20.0

…and 21 more

Overview

Affected versions of this package are vulnerable to Information Disclosure. The file permissions on the file created by com.google.common.io.Files.createTempDir allow an attacker running a malicious program co-resident on the same machine to steal secrets stored in this directory. This is because, by default, on unix-like operating systems the /tmp directory is shared between all users, so if the correct file permissions aren't set by the directory/file creator, the file becomes readable by all other users on that system.

PoC

File guavaTempDir = com.google.common.io.Files.createTempDir();
System.out.println("Guava Temp Dir: " + guavaTempDir.getName());
runLS(guavaTempDir.getParentFile(), guavaTempDir); // Prints the file permissions -> drwxr-xr-x
File child = new File(guavaTempDir, "guava-child.txt");
child.createNewFile();
runLS(guavaTempDir, child); // Prints the file permissions -> -rw-r--r--

For Android developers, choosing a temporary directory API provided by Android is recommended, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Remediation

There is no fix for com.google.guava:guava. However, in version 30.0 and above, the vulnerable functionality has been deprecated. In oder to mitigate this vulnerability, upgrade to version 30.0 or higher and ensure your dependencies don't use the createTempDir or createTempFile methods.

References

Information Disclosure vulnerability report

low severity

Information Exposure

Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib
Introduced through: dev.langchain4j:langchain4j@0.29.1, dev.langchain4j:langchain4j-anthropic@0.29.1 and others

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-anthropic@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-hugging-face@0.29.1 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.okhttp3:okhttp-sse@4.12.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › dev.langchain4j:langchain4j-local-ai@0.29.1 › dev.langchain4j:langchain4j-open-ai@0.29.1 › dev.ai4j:openai4j@0.17.0 › com.squareup.retrofit2:converter-gson@2.9.0 › com.squareup.retrofit2:retrofit@2.9.0 › com.squareup.okhttp3:okhttp@4.12.0 › com.squareup.okio:okio@3.6.0 › com.squareup.okio:okio-jvm@3.6.0 › org.jetbrains.kotlin:kotlin-stdlib-jdk8@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib-jdk7@1.8.21 › org.jetbrains.kotlin:kotlin-stdlib@1.8.21

…and 71 more

Overview

org.jetbrains.kotlin:kotlin-stdlib is a Kotlin Standard Library for JVM.

Affected versions of this package are vulnerable to Information Exposure. A Kotlin application using createTempDir or createTempFile and placing sensitive information within either of these locations would be leaking this information in a read-only way to other users also on this system.

Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

PoC by JLLeitschuh

package org.jlleitschuh.sandbox

import org.junit.jupiter.api.Test
import java.io.BufferedReader
import java.io.File
import java.io.IOException
import java.io.InputStreamReader
import java.nio.file.Files

class KotlinTempDirectoryPermissionCheck {
    @Test
    fun `kotlin check default directory permissions`() {
        val dir = createTempDir()
        runLS(dir.parentFile, dir) // Prints drwxr-xr-x
    }

    @Test
    fun `Files check default directory permissions`() {
        val dir = Files.createTempDirectory("random-directory")
        runLS(dir.toFile().parentFile, dir.toFile()) // Prints drwx------
    }

    @Test
    fun `kotlin check default file permissions`() {
        val file = createTempFile()
        runLS(file.parentFile, file) // Prints -rw-r--r--
    }

    @Test
    fun `Files check default file permissions`() {
        val file = Files.createTempFile("random-file", ".txt")
        runLS(file.toFile().parentFile, file.toFile()) // Prints -rw-------
    }

    private fun runLS(file: File, lookingFor: File) {
        val processBuilder = ProcessBuilder()
        processBuilder.command("ls", "-l", file.absolutePath)
        try {
            val process = processBuilder.start()
            val output = StringBuilder()
            val reader = BufferedReader(
                InputStreamReader(process.inputStream)
            )
            reader.lines().forEach { line ->
                if (line.contains("total")) {
                    output.append(line).append('\n')
                }
                if (line.contains(lookingFor.name)) {
                    output.append(line).append('\n')
                }
            }
            val exitVal = process.waitFor()
            if (exitVal == 0) {
                println("Success!")
                println(output)
            } else {
                //abnormal...
            }
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: InterruptedException) {
            e.printStackTrace()
        }
    }
}

Remediation

Upgrade org.jetbrains.kotlin:kotlin-stdlib to version 2.1.0 or higher.

References

Information Exposure vulnerability report

low severity

Information Exposure

Vulnerable module: junit:junit
Introduced through: io.swagger.parser.v3:swagger-parser@2.0.2

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › junit:junit@4.8.1

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › io.swagger.parser.v3:swagger-parser@2.0.2 › io.swagger.parser.v3:swagger-parser-v2-converter@2.0.2 › io.swagger.parser.v3:swagger-parser-v3@2.0.2 › junit:junit@4.8.1

Remediation: Upgrade to io.swagger.parser.v3:swagger-parser@2.1.22.

Overview

junit:junit is an unit testing framework for Java

Affected versions of this package are vulnerable to Information Exposure. The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

Note: This vulnerability does not allow other users to overwrite the contents of these directories or files. This only affects Unix like systems.

Remediation

Upgrade junit:junit to version 4.13.1 or higher.

References

Information Exposure vulnerability report

low severity

Improper Handling of Case Sensitivity

Vulnerable module: org.springframework:spring-context
Introduced through: org.springframework:spring-context@6.1.5

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.

Overview

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to String.toLowerCase() having some Locale dependent exceptions that could potentially result in fields not protected as expected.

Note:

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive.

This vulnerability was also fixed in commercial versions 5.3.41 and 6.0.25.

Remediation

Upgrade org.springframework:spring-context to version 6.1.14 or higher.

References

Improper Handling of Case Sensitivity vulnerability report

low severity

Improper Handling of Case Sensitivity

Vulnerable module: org.springframework:spring-core
Introduced through: org.springframework:spring-context@6.1.5

Detailed paths

Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5 › org.springframework:spring-core@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5 › org.springframework:spring-beans@6.1.5 › org.springframework:spring-core@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5 › org.springframework:spring-aop@6.1.5 › org.springframework:spring-core@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5 › org.springframework:spring-expression@6.1.5 › org.springframework:spring-core@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.
Introduced through: vishalmysore/tools4ai@vishalmysore/tools4ai#e74951e1f11ec3d6018631655104448eaf4f52a2 › org.springframework:spring-context@6.1.5 › org.springframework:spring-aop@6.1.5 › org.springframework:spring-beans@6.1.5 › org.springframework:spring-core@6.1.5

Remediation: Upgrade to org.springframework:spring-context@6.1.14.

…and 2 more

Overview

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Note:

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive.

This vulnerability was also fixed in commercial versions 5.3.41 and 6.0.25.

Remediation

Upgrade org.springframework:spring-core to version 6.1.14 or higher.

References

Improper Handling of Case Sensitivity vulnerability report

vishalmysore/tools4ai

Vulnerabilities

Dependencies

Source

Commit

Find, fix and prevent vulnerabilities in your code.

critical severity

Deserialization of Untrusted Data

Detailed paths

Overview

Details

Remediation

References

high severity

XML External Entity (XXE) Injection

Detailed paths

Overview

Details

Remediation

References

high severity

Infinite loop

Detailed paths

Overview

Remediation

References

medium severity

Uncontrolled Resource Consumption

Detailed paths

Overview

Remediation

References

medium severity

Deserialization of Untrusted Data

Detailed paths

Overview

Details

Remediation

References

medium severity

Observable Discrepancy

Detailed paths

Overview

Remediation

References

medium severity

Directory Traversal

Detailed paths

Overview

Details

Remediation

References

medium severity

Allocation of Resources Without Limits or Throttling

Detailed paths

Overview

Remediation

References

medium severity new

MPL-2.0 license

Detailed paths

low severity

Creation of Temporary File in Directory with Insecure Permissions

Detailed paths

Overview

Remediation

References

low severity

Information Disclosure

Detailed paths

Overview

PoC

Remediation

References

low severity

Information Exposure

Detailed paths

Overview

PoC by JLLeitschuh

Remediation

medium severity

new