ioana-nicolae/baragon

Load balancer API

Baragon

Baragon is a system for automating load balancer configuration updates. It pairs well with the Singularity Mesos framework.

Contents

• Baragon Basics
• Getting Started
  • Quick Start
  • Detailed Setup Guide
  • Example Baragon Service Configuration
  • Example Baragon Agent Configuration
• Quick Start With Docker Compose
• BaragonUI
• API Docs
• Developing

Baragon Basics

Baragon is made up of two services:

• BaragonService -- coordination service

• BaragonAgentService -- applies changes on the actual load balancer

When a web service changes (i.e. upstreams added / removed), POST a BaragonRequest JSON object to BaragonService's /[contextPath]/request endpoint like this one:

{
  "loadBalancerRequestId": "4",
  "loadBalancerService": {
    "serviceId": "1",
    "owners": ["foo"],
    "serviceBasePath": "/basepath",
    "loadBalancerGroups": ["loadBalancerGroupName"]
  },
  "addUpstreams": ["1.1.1.1:80"],
  "removeUpstreams": []
}

• BaragonService will fan out the update to all BaragonAgents in the specified loadBalancerGroups
• BaragonAgents will apply the changes on the load balancer using templates provided in its configuration and report back a Success or Failure to BaragonService
• Polling the BaragonService request status url (/[contextPath]/request/{loadBalancerRequestId}) will indicate the current status of the request

Check out the API Docs for additional BaragonRequest fields and returned values.

Getting Started

For more details on configuring and using Baragon, check out the detailed setup and management guide

** Prerequisite: A working ZooKeeper cluster **

1. Build JARs via mvn clean package.

2. Create a configuration file for Baragon Service and Baragon Agent. These are an extended version of a Dropwizard configuration file. Details on configurable fields can be found in the example configs below and in the detailed setup and management guide

• Example Baragon Service Configuration. This will be referenced as $SERVICE_CONFIG_YAML.
• Example Baragon Agent Configuration. This will be referenced as $AGENT_CONFIG_YAML.

3. Copy BaragonService-*-SNAPSHOT.jar and $SERVICE_CONFIG_YAML onto one or more hosts, and start the service via java -jar BaragonService-*-SNAPSHOT.jar server $SERVICE_CONFIG_YAML.

4. Copy BaragonAgentService-*-SNAPSHOT.jar and $AGENT_CONFIG_YAML onto each of your load balancer hosts. Start the BaragonAgent service via java -jar BaragonAgentService-*-SNAPSHOT.jar server $AGENT_CONFIG_YAML.

Quickstart with Docker Compose

To get an example cluster up and running, you can install docker and docker-compose.

Simply run docker-compose up to bring up:

• zookeper container
• Baragon Service container
• Two Baragon Agent + Nginx containers

The Baragon UI will be available at localhost:8080 and nginx at localhost:80.

If using boot2docker replace localhost with the boot2docker ip

Nginx's config directories that BaragonAgent writes to will also be mounted as volumes in the docker/configs folder on your local machine.

BaragonUI

Baragon comes with a UI for visualization and easier management of load balancer paths and upstreams. By default it will be available in a read-only mode at /[contextPath]/ui see the Example Baragon Service Configuration or detailed setup and management guide for more details on configuring BaragonUI behavior.

Baragon API Docs

Full documentation on the Baragon Service API can be found here

baragon's Issues

HorizonCore-0.1.2.jar: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - HorizonCore-0.1.2.jar

Path to dependency file: /BaragonClient/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
WS-2019-0379	Medium	6.5	commons-codec-1.10.jar	Transitive	N/A	❌

Details

WS-2019-0379

Vulnerable Library - commons-codec-1.10.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: /BaragonCore/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar

Dependency Hierarchy:

• HorizonCore-0.1.2.jar (Root Library)
  • ❌ commons-codec-1.10.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

dropwizard-jersey-1.3.12.jar: 1 vulnerabilities (highest severity is: 7.0)

Vulnerable Library - dropwizard-jersey-1.3.12.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-27216	High	7.0	jetty-webapp-9.4.18.v20190429.jar	Transitive	1.3.27	✅

Details

CVE-2020-27216

Vulnerable Library - jetty-webapp-9.4.18.v20190429.jar

Jetty web application support

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.18.v20190429/jetty-webapp-9.4.18.v20190429.jar

Dependency Hierarchy:

• dropwizard-jersey-1.3.12.jar (Root Library)
  • ❌ jetty-webapp-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Publish Date: 2020-10-23

URL: CVE-2020-27216

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921

Release Date: 2020-10-23

Fix Resolution (org.eclipse.jetty:jetty-webapp): 9.4.33.v20201020

Direct dependency fix Resolution (io.dropwizard:dropwizard-jersey): 1.3.27

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

jetty-server-9.4.18.v20190429.jar: 5 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jetty-server-9.4.18.v20190429.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-28165	High	7.5	jetty-io-9.4.18.v20190429.jar	Transitive	9.4.39.v20210325	✅
CVE-2021-28169	Medium	5.3	jetty-server-9.4.18.v20190429.jar	Direct	9.4.41.v20210516	✅
CVE-2020-27218	Medium	4.8	jetty-server-9.4.18.v20190429.jar	Direct	9.4.35.v20201120	✅
CVE-2021-34428	Low	3.5	jetty-server-9.4.18.v20190429.jar	Direct	9.4.41.v20210516	✅
CVE-2022-2047	Low	2.7	jetty-server-9.4.18.v20190429.jar	Direct	9.4.47.v20220610	✅

Details

CVE-2021-28165

Vulnerable Library - jetty-io-9.4.18.v20190429.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-io/9.4.18.v20190429/jetty-io-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-io/9.4.18.v20190429/jetty-io-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-io/9.4.18.v20190429/jetty-io-9.4.18.v20190429.jar

Dependency Hierarchy:

• jetty-server-9.4.18.v20190429.jar (Root Library)
  • ❌ jetty-io-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Publish Date: 2021-04-01

URL: CVE-2021-28165

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-26vr-8j45-3r4w

Release Date: 2021-04-01

Fix Resolution (org.eclipse.jetty:jetty-io): 9.4.39.v20210325

Direct dependency fix Resolution (org.eclipse.jetty:jetty-server): 9.4.39.v20210325

⛑️ Automatic Remediation is available for this issue

CVE-2021-28169

Vulnerable Library - jetty-server-9.4.18.v20190429.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar

Dependency Hierarchy:

• ❌ jetty-server-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Publish Date: 2021-06-09

URL: CVE-2021-28169

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gwcr-j4wh-j3cq

Release Date: 2021-06-09

Fix Resolution: 9.4.41.v20210516

⛑️ Automatic Remediation is available for this issue

CVE-2020-27218

Vulnerable Library - jetty-server-9.4.18.v20190429.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar

Dependency Hierarchy:

• ❌ jetty-server-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Publish Date: 2020-11-28

URL: CVE-2020-27218

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-86wm-rrjm-8wh8

Release Date: 2020-11-28

Fix Resolution: 9.4.35.v20201120

⛑️ Automatic Remediation is available for this issue

CVE-2021-34428

Vulnerable Library - jetty-server-9.4.18.v20190429.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar

Dependency Hierarchy:

• ❌ jetty-server-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Publish Date: 2021-06-22

URL: CVE-2021-34428

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Physical
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m6cp-vxjx-65j6

Release Date: 2021-06-22

Fix Resolution: 9.4.41.v20210516

⛑️ Automatic Remediation is available for this issue

CVE-2022-2047

Vulnerable Library - jetty-server-9.4.18.v20190429.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-server/9.4.18.v20190429/jetty-server-9.4.18.v20190429.jar

Dependency Hierarchy:

• ❌ jetty-server-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

Publish Date: 2022-07-07

URL: CVE-2022-2047

CVSS 3 Score Details (2.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj7v-27pg-wf7q

Release Date: 2022-07-07

Fix Resolution: 9.4.47.v20220610

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

hibernate-validator-5.4.3.Final.jar: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - hibernate-validator-5.4.3.Final.jar

Hibernate's Bean Validation (JSR-303) reference implementation.

Library home page: http://hibernate.org/validator

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar,/m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar,/m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-10693	Medium	5.3	hibernate-validator-5.4.3.Final.jar	Direct	6.0.0.Alpha1	✅

Details

CVE-2020-10693

Vulnerable Library - hibernate-validator-5.4.3.Final.jar

Hibernate's Bean Validation (JSR-303) reference implementation.

Library home page: http://hibernate.org/validator

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar,/m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar,/m2/repository/org/hibernate/hibernate-validator/5.4.3.Final/hibernate-validator-5.4.3.Final.jar

Dependency Hierarchy:

• ❌ hibernate-validator-5.4.3.Final.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Publish Date: 2020-05-06

URL: CVE-2020-10693

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/

Release Date: 2020-05-06

Fix Resolution: 6.0.0.Alpha1

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

metrics-graphite-4.0.5.jar: 1 vulnerabilities (highest severity is: 5.9)

Vulnerable Library - metrics-graphite-4.0.5.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/rabbitmq/amqp-client/4.4.1/amqp-client-4.4.1.jar,/home/wss-scanner/.m2/repository/com/rabbitmq/amqp-client/4.4.1/amqp-client-4.4.1.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2018-11087	Medium	5.9	amqp-client-4.4.1.jar	Transitive	4.1.0	✅

Details

CVE-2018-11087

Vulnerable Library - amqp-client-4.4.1.jar

The RabbitMQ Java client library allows Java applications to interface with RabbitMQ.

Library home page: http://www.rabbitmq.com

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/rabbitmq/amqp-client/4.4.1/amqp-client-4.4.1.jar,/home/wss-scanner/.m2/repository/com/rabbitmq/amqp-client/4.4.1/amqp-client-4.4.1.jar

Dependency Hierarchy:

• metrics-graphite-4.0.5.jar (Root Library)
  • ❌ amqp-client-4.4.1.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

Publish Date: 2018-09-14

URL: CVE-2018-11087

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-11087

Release Date: 2018-09-14

Fix Resolution (com.rabbitmq:amqp-client): 4.8.0

Direct dependency fix Resolution (io.dropwizard.metrics:metrics-graphite): 4.1.0

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

jetty-servlets-9.4.18.v20190429.jar: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - jetty-servlets-9.4.18.v20190429.jar

Utility Servlets from Jetty

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar,/m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar,/m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-28169	Medium	5.3	jetty-servlets-9.4.18.v20190429.jar	Direct	9.4.41.v20210516	✅

Details

CVE-2021-28169

Vulnerable Library - jetty-servlets-9.4.18.v20190429.jar

Utility Servlets from Jetty

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar,/m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar,/m2/repository/org/eclipse/jetty/jetty-servlets/9.4.18.v20190429/jetty-servlets-9.4.18.v20190429.jar

Dependency Hierarchy:

• ❌ jetty-servlets-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Publish Date: 2021-06-09

URL: CVE-2021-28169

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gwcr-j4wh-j3cq

Release Date: 2021-06-09

Fix Resolution: 9.4.41.v20210516

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

jackson-databind-2.9.9.jar: 50 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2019-14540	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.2	✅
CVE-2019-17531	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.1	✅
CVE-2019-16335	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10	✅
CVE-2019-17267	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10	✅
CVE-2019-16942	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.1	✅
CVE-2020-8840	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.3	✅
CVE-2019-16943	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.1	✅
CVE-2019-14893	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10	✅
CVE-2019-14892	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10	✅
CVE-2020-9546	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2019-14379	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.9.2	✅
CVE-2020-9547	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-9548	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2019-20330	High	9.8	jackson-databind-2.9.9.jar	Direct	2.9.10.2	✅
CVE-2020-10968	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-10969	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-11111	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-11113	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-11112	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-10672	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-10673	High	8.8	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-11619	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-35728	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36189	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36188	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-11620	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-10650	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.4	✅
CVE-2020-36181	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36180	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-35490	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-36183	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36182	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36185	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-35491	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-36184	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36187	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-36186	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2021-20190	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.7	✅
CVE-2020-36179	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.8	✅
CVE-2020-24616	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-14060	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-14061	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-14062	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-24750	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-14195	High	8.1	jackson-databind-2.9.9.jar	Direct	2.9.10.5	✅
CVE-2020-25649	High	7.5	jackson-databind-2.9.9.jar	Direct	2.9.10.7	✅
CVE-2019-14439	High	7.5	jackson-databind-2.9.9.jar	Direct	2.9.9.2	✅
CVE-2020-36518	High	7.5	jackson-databind-2.9.9.jar	Direct	2.12.6.1	✅
CVE-2019-12814	Medium	5.9	jackson-databind-2.9.9.jar	Direct	2.9.9.1	✅
CVE-2019-12384	Medium	5.9	jackson-databind-2.9.9.jar	Direct	2.9.9.1	✅

Details

Partial details (19 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2019-14540

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540

Release Date: 2019-09-15

Fix Resolution: 2.9.10.2

⛑️ Automatic Remediation is available for this issue

CVE-2019-17531

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.9.10.1

⛑️ Automatic Remediation is available for this issue

CVE-2019-16335

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

Publish Date: 2019-09-15

URL: CVE-2019-16335

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-09-15

Fix Resolution: 2.9.10

⛑️ Automatic Remediation is available for this issue

CVE-2019-17267

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-07

URL: CVE-2019-17267

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-10-07

Fix Resolution: 2.9.10

⛑️ Automatic Remediation is available for this issue

CVE-2019-16942

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

⛑️ Automatic Remediation is available for this issue

CVE-2020-8840

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-02-10

Fix Resolution: 2.9.10.3

⛑️ Automatic Remediation is available for this issue

CVE-2019-16943

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

⛑️ Automatic Remediation is available for this issue

CVE-2019-14893

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Publish Date: 2020-03-02

URL: CVE-2019-14893

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14893

Release Date: 2020-03-02

Fix Resolution: 2.9.10

⛑️ Automatic Remediation is available for this issue

CVE-2019-14892

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Publish Date: 2020-03-02

URL: CVE-2019-14892

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-04

Fix Resolution: 2.9.10

⛑️ Automatic Remediation is available for this issue

CVE-2020-9546

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2019-14379

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Publish Date: 2019-07-29

URL: CVE-2019-14379

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14379

Release Date: 2019-07-29

Fix Resolution: 2.9.9.2

⛑️ Automatic Remediation is available for this issue

CVE-2020-9547

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-9548

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2019-20330

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03

URL: CVE-2019-20330

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-03

Fix Resolution: 2.9.10.2

⛑️ Automatic Remediation is available for this issue

CVE-2020-10968

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Publish Date: 2020-03-26

URL: CVE-2020-10968

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10968

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-10969

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Publish Date: 2020-03-26

URL: CVE-2020-10969

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-11111

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Publish Date: 2020-03-31

URL: CVE-2020-11111

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-11113

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Publish Date: 2020-03-31

URL: CVE-2020-11113

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-11112

Vulnerable Library - jackson-databind-2.9.9.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar,/m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Publish Date: 2020-03-31

URL: CVE-2020-11112

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

dropwizard-configuration-1.3.12.jar: 2 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - dropwizard-configuration-1.3.12.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-11002	High	8.8	dropwizard-validation-1.3.12.jar	Transitive	1.3.21	✅
CVE-2020-5245	High	8.8	dropwizard-validation-1.3.12.jar	Transitive	1.3.19	✅

Details

CVE-2020-11002

Vulnerable Library - dropwizard-validation-1.3.12.jar

Dropwizard is a Java framework for developing ops-friendly, high-performance, RESTful web applications.

Library home page: http://www.dropwizard.io/1.3.12

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar

Dependency Hierarchy:

• dropwizard-configuration-1.3.12.jar (Root Library)
  • ❌ dropwizard-validation-1.3.12.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Publish Date: 2020-04-10

URL: CVE-2020-11002

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8jpx-m2wh-2v34

Release Date: 2020-04-13

Fix Resolution (io.dropwizard:dropwizard-validation): 1.3.21

Direct dependency fix Resolution (io.dropwizard:dropwizard-configuration): 1.3.21

⛑️ Automatic Remediation is available for this issue

CVE-2020-5245

Vulnerable Library - dropwizard-validation-1.3.12.jar

Dropwizard is a Java framework for developing ops-friendly, high-performance, RESTful web applications.

Library home page: http://www.dropwizard.io/1.3.12

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar,/home/wss-scanner/.m2/repository/io/dropwizard/dropwizard-validation/1.3.12/dropwizard-validation-1.3.12.jar

Dependency Hierarchy:

• dropwizard-configuration-1.3.12.jar (Root Library)
  • ❌ dropwizard-validation-1.3.12.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Publish Date: 2020-02-24

URL: CVE-2020-5245

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5245

Release Date: 2020-02-24

Fix Resolution (io.dropwizard:dropwizard-validation): 1.3.19

Direct dependency fix Resolution (io.dropwizard:dropwizard-configuration): 1.3.19

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

aws-java-sdk-core-1.11.497.jar: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - aws-java-sdk-core-1.11.497.jar

Path to dependency file: /BaragonCore/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-28491	High	7.5	jackson-dataformat-cbor-2.9.9.jar	Transitive	1.11.498	✅
CVE-2020-13956	Medium	5.3	httpclient-4.5.5.jar	Transitive	1.11.893	✅

Details

CVE-2020-28491

Vulnerable Library - jackson-dataformat-cbor-2.9.9.jar

Support for reading and writing Concise Binary Object Representation ([CBOR](https://www.rfc-editor.org/info/rfc7049) encoded data using Jackson abstractions (streaming API, data binding, tree model)

Library home page: http://github.com/FasterXML/jackson-dataformats-binary

Path to dependency file: /BaragonServiceIntegrationTests/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar

Dependency Hierarchy:

• aws-java-sdk-core-1.11.497.jar (Root Library)
  • ❌ jackson-dataformat-cbor-2.9.9.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Publish Date: 2021-02-18

URL: CVE-2020-28491

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491

Release Date: 2021-02-18

Fix Resolution (com.fasterxml.jackson.dataformat:jackson-dataformat-cbor): 2.11.4

Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.498

⛑️ Automatic Remediation is available for this issue

CVE-2020-13956

Vulnerable Library - httpclient-4.5.5.jar

Apache HttpComponents Client

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar

Dependency Hierarchy:

• aws-java-sdk-core-1.11.497.jar (Root Library)
  • ❌ httpclient-4.5.5.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-12-02

Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.13

Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.893

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

jackson-dataformat-yaml-2.9.9.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jackson-dataformat-yaml-2.9.9.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2017-18640	High	7.5	snakeyaml-1.23.jar	Transitive	2.10.4	✅

Details

CVE-2017-18640

Vulnerable Library - snakeyaml-1.23.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: /BaragonData/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.23/snakeyaml-1.23.jar

Dependency Hierarchy:

• jackson-dataformat-yaml-2.9.9.jar (Root Library)
  • ❌ snakeyaml-1.23.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Publish Date: 2019-12-12

URL: CVE-2017-18640

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640

Release Date: 2019-12-12

Fix Resolution (org.yaml:snakeyaml): 1.26

Direct dependency fix Resolution (com.fasterxml.jackson.dataformat:jackson-dataformat-yaml): 2.10.4

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

google-api-client-1.25.0.jar: 2 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - google-api-client-1.25.0.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/oauth-client/google-oauth-client/1.25.0/google-oauth-client-1.25.0.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-7692	High	9.1	google-oauth-client-1.25.0.jar	Transitive	1.30.10	✅
CVE-2021-22573	High	7.3	google-oauth-client-1.25.0.jar	Transitive	1.35.0	✅

Details

CVE-2020-7692

Vulnerable Library - google-oauth-client-1.25.0.jar

Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.

Library home page: https://github.com/google/google-oauth-java-client

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/oauth-client/google-oauth-client/1.25.0/google-oauth-client-1.25.0.jar

Dependency Hierarchy:

• google-api-client-1.25.0.jar (Root Library)
  • ❌ google-oauth-client-1.25.0.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

Publish Date: 2020-07-09

URL: CVE-2020-7692

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-09

Fix Resolution (com.google.oauth-client:google-oauth-client): 1.31.0

Direct dependency fix Resolution (com.google.api-client:google-api-client): 1.30.10

⛑️ Automatic Remediation is available for this issue

CVE-2021-22573

Vulnerable Library - google-oauth-client-1.25.0.jar

Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.

Library home page: https://github.com/google/google-oauth-java-client

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/oauth-client/google-oauth-client/1.25.0/google-oauth-client-1.25.0.jar

Dependency Hierarchy:

• google-api-client-1.25.0.jar (Root Library)
  • ❌ google-oauth-client-1.25.0.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above

Publish Date: 2022-05-03

URL: CVE-2021-22573

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22573

Release Date: 2022-05-03

Fix Resolution (com.google.oauth-client:google-oauth-client): 1.33.3

Direct dependency fix Resolution (com.google.api-client:google-api-client): 1.35.0

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

handlebars-1.3.1.jar: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - handlebars-1.3.1.jar

Logic-less and semantic templates with Java

Library home page: https://github.com/jknack/handlebars.java

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/github/jknack/handlebars/1.3.1/handlebars-1.3.1.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-23369	High	9.8	handlebars-1.3.1.jar	Direct	4.2.1	✅

Details

CVE-2021-23369

Vulnerable Library - handlebars-1.3.1.jar

Logic-less and semantic templates with Java

Library home page: https://github.com/jknack/handlebars.java

Path to dependency file: /BaragonAgentService/pom.xml

Path to vulnerable library: /m2/repository/com/github/jknack/handlebars/1.3.1/handlebars-1.3.1.jar

Dependency Hierarchy:

• ❌ handlebars-1.3.1.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23369

Release Date: 2021-04-12

Fix Resolution: 4.2.1

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

dropwizard-jetty-1.3.12.jar: 3 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - dropwizard-jetty-1.3.12.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-27223	Medium	5.3	jetty-http-9.4.18.v20190429.jar	Transitive	2.0.0-rc0+test8	✅
CVE-2021-28169	Medium	5.3	jetty-http-9.4.18.v20190429.jar	Transitive	2.0.0-rc0+test8	✅
CVE-2022-2047	Low	2.7	jetty-http-9.4.18.v20190429.jar	Transitive	2.0.0-rc0+test8	✅

Details

CVE-2020-27223

Vulnerable Library - jetty-http-9.4.18.v20190429.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar

Dependency Hierarchy:

• dropwizard-jetty-1.3.12.jar (Root Library)
  • ❌ jetty-http-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Publish Date: 2021-02-26

URL: CVE-2020-27223

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m394-8rww-3jr7

Release Date: 2021-02-26

Fix Resolution (org.eclipse.jetty:jetty-http): 9.4.37.v20210219

Direct dependency fix Resolution (io.dropwizard:dropwizard-jetty): 2.0.0-rc0+test8

⛑️ Automatic Remediation is available for this issue

CVE-2021-28169

Vulnerable Library - jetty-http-9.4.18.v20190429.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar

Dependency Hierarchy:

• dropwizard-jetty-1.3.12.jar (Root Library)
  • ❌ jetty-http-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Publish Date: 2021-06-09

URL: CVE-2021-28169

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gwcr-j4wh-j3cq

Release Date: 2021-06-09

Fix Resolution (org.eclipse.jetty:jetty-http): 9.4.41.v20210516

Direct dependency fix Resolution (io.dropwizard:dropwizard-jetty): 2.0.0-rc0+test8

⛑️ Automatic Remediation is available for this issue

CVE-2022-2047

Vulnerable Library - jetty-http-9.4.18.v20190429.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar,/home/wss-scanner/.m2/repository/org/eclipse/jetty/jetty-http/9.4.18.v20190429/jetty-http-9.4.18.v20190429.jar

Dependency Hierarchy:

• dropwizard-jetty-1.3.12.jar (Root Library)
  • ❌ jetty-http-9.4.18.v20190429.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

Publish Date: 2022-07-07

URL: CVE-2022-2047

CVSS 3 Score Details (2.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj7v-27pg-wf7q

Release Date: 2022-07-07

Fix Resolution (org.eclipse.jetty:jetty-http): 9.4.47.v20220610

Direct dependency fix Resolution (io.dropwizard:dropwizard-jetty): 2.0.0-rc0+test8

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

guava-25.0-jre.jar: 1 vulnerabilities (highest severity is: 3.3)

Vulnerable Library - guava-25.0-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: /BaragonCore/pom.xml

Path to vulnerable library: /m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-8908	Low	3.3	guava-25.0-jre.jar	Direct	30.0-android	✅

Details

CVE-2020-8908

Vulnerable Library - guava-25.0-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: /BaragonCore/pom.xml

Path to vulnerable library: /m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar,/m2/repository/com/google/guava/guava/25.0-jre/guava-25.0-jre.jar

Dependency Hierarchy:

• ❌ guava-25.0-jre.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: 30.0-android

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

async-http-client-1.9.38.jar: 1 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - async-http-client-1.9.38.jar

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty/3.10.6.Final/netty-3.10.6.Final.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2019-20444	High	9.1	netty-3.10.6.Final.jar	Transitive	1.9.39	✅

Details

CVE-2019-20444

Vulnerable Library - netty-3.10.6.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty/3.10.6.Final/netty-3.10.6.Final.jar

Dependency Hierarchy:

• async-http-client-1.9.38.jar (Root Library)
  • ❌ netty-3.10.6.Final.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Publish Date: 2020-01-29

URL: CVE-2019-20444

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444

Release Date: 2020-01-29

Fix Resolution (io.netty:netty): 4.0.0.Alpha1

Direct dependency fix Resolution (com.ning:async-http-client): 1.9.39

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.

logback-classic-1.2.3.jar: 1 vulnerabilities (highest severity is: 6.6)

Vulnerable Library - logback-classic-1.2.3.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-42550	Medium	6.6	detected in multiple dependencies	Direct	1.2.8	✅

Details

CVE-2021-42550

Vulnerable Libraries - logback-classic-1.2.3.jar, logback-core-1.2.3.jar

logback-classic-1.2.3.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /BaragonService/pom.xml

Path to vulnerable library: /m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar

Dependency Hierarchy:

• ❌ logback-classic-1.2.3.jar (Vulnerable Library)

logback-core-1.2.3.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /BaragonServiceIntegrationTests/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar,/home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar

Dependency Hierarchy:

• logback-classic-1.2.3.jar (Root Library)
  • ❌ logback-core-1.2.3.jar (Vulnerable Library)

Found in HEAD commit: 9acfcda13ab898fa978dab6abb1938e7014e5643

Found in base branch: master

Vulnerability Details

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Publish Date: 2021-12-16

URL: CVE-2021-42550

CVSS 3 Score Details (6.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2021-42550

Release Date: 2021-12-16

Fix Resolution (ch.qos.logback:logback-core): 1.2.8

Direct dependency fix Resolution (ch.qos.logback:logback-classic): 1.2.8

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.