ismaelhamed/akka.persistence.oracle

Akka.NET Persistence journal and snapshot store backed by Oracle ODP.NET, Managed Driver

Hi there 👋

akka.persistence.oracle's Issues

akka.persistence.oracle.1.4.39.nupkg: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - akka.persistence.oracle.1.4.39.nupkg

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/12.0.3/newtonsoft.json.12.0.3.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (akka.persistence.oracle.1.4.39.nupkg version)	Remediation Available
WS-2022-0161	High	7.5	newtonsoft.json.12.0.3.nupkg	Transitive	N/A*	❌
CVE-2022-1941	High	7.5	google.protobuf.3.19.4.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

WS-2022-0161

Vulnerable Library - newtonsoft.json.12.0.3.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.12.0.3.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/12.0.3/newtonsoft.json.12.0.3.nupkg

Dependency Hierarchy:

• akka.persistence.oracle.1.4.39.nupkg (Root Library)
  • akka.persistence.sql.common.1.4.45.nupkg
    • akka.persistence.1.4.45.nupkg
      • akka.1.4.45.nupkg
        • ❌ newtonsoft.json.12.0.3.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Improper Handling of Exceptional Conditions in Newtonsoft.Json.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed. Exploiting this vulnerability results in Denial Of Service (DoS), and it is exploitable when an attacker sends 5 requests that cause SOE in time frame of 5 minutes. This vulnerability affects Internet Information Services (IIS) Applications.

Publish Date: 2022-06-22

URL: WS-2022-0161

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-22

Fix Resolution: Newtonsoft.Json - 13.0.1;Microsoft.Extensions.ApiDescription.Server - 6.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-1941

Vulnerable Library - google.protobuf.3.19.4.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Dependency Hierarchy:

• akka.persistence.oracle.1.4.39.nupkg (Root Library)
  • akka.persistence.sql.common.1.4.45.nupkg
    • akka.persistence.1.4.45.nupkg
      • ❌ google.protobuf.3.19.4.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

Why there is no index or PK on Ordering column?

I noticed there is no PK or index in the Ordering Column, which is not the same as SQL Server version is there a reason for this ?

microsoft.extensions.configuration.xml.6.0.0.nupkg: 1 vulnerabilities (highest severity is: 5.9) - autoclosed

Vulnerable Library - microsoft.extensions.configuration.xml.6.0.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/6.0.0/system.security.cryptography.xml.6.0.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (microsoft.extensions.configuration.xml.6.0.0.nupkg version)	Remediation Available
CVE-2022-34716	Medium	5.9	system.security.cryptography.xml.6.0.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-34716

Vulnerable Library - system.security.cryptography.xml.6.0.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.6.0.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/6.0.0/system.security.cryptography.xml.6.0.0.nupkg

Dependency Hierarchy:

• microsoft.extensions.configuration.xml.6.0.0.nupkg (Root Library)
  • ❌ system.security.cryptography.xml.6.0.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

• Any .NET 6.0 application running on .NET 6.0.7 or earlier.
• Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

• If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
• If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

Publish Date: 2022-08-09

URL: CVE-2022-34716

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2m65-m22p-9wjw

Release Date: 2022-08-09

Fix Resolution: Microsoft.AspNetCore.App.Runtime.linux-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.osx-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x86 - 3.1.28,6.0.8;System.Security.Cryptography.Xml - 4.7.1,6.0.1

Step up your Open Source Security Game with Mend here

oracle.manageddataaccess.core.3.21.80.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - oracle.manageddataaccess.core.3.21.80.nupkg

Oracle Data Provider for .NET Core for Oracle Database

Library home page: https://api.nuget.org/packages/oracle.manageddataaccess.core.3.21.80.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /racle.manageddataaccess.core/3.21.80/oracle.manageddataaccess.core.3.21.80.nupkg,/home/wss-scanner/.nuget/packages/oracle.manageddataaccess.core/3.21.80/oracle.manageddataaccess.core.3.21.80.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (oracle.manageddataaccess.core.3.21.80.nupkg version)	Remediation Available
CVE-2023-21893	High	7.5	oracle.manageddataaccess.core.3.21.80.nupkg	Direct	Oracle.ManagedDataAccess - 21.9.0, Oracle.ManagedDataAccess.Core - 3.21.90	❌

Details

CVE-2023-21893

Vulnerable Library - oracle.manageddataaccess.core.3.21.80.nupkg

Oracle Data Provider for .NET Core for Oracle Database

Library home page: https://api.nuget.org/packages/oracle.manageddataaccess.core.3.21.80.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /racle.manageddataaccess.core/3.21.80/oracle.manageddataaccess.core.3.21.80.nupkg,/home/wss-scanner/.nuget/packages/oracle.manageddataaccess.core/3.21.80/oracle.manageddataaccess.core.3.21.80.nupkg

Dependency Hierarchy:

• ❌ oracle.manageddataaccess.core.3.21.80.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Publish Date: 2023-01-18

URL: CVE-2023-21893

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5pm2-9mr2-3frq

Release Date: 2023-01-18

Fix Resolution: Oracle.ManagedDataAccess - 21.9.0, Oracle.ManagedDataAccess.Core - 3.21.90

Step up your Open Source Security Game with Mend here

move or fork to odp.net core

odp.net.core now supports .net standart. I believe it is a good idea to move to odp.net core or fork the project.

akka.persistence.query.sql.1.4.39.nupkg: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - akka.persistence.query.sql.1.4.39.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/12.0.3/newtonsoft.json.12.0.3.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
WS-2022-0161	High	7.5	newtonsoft.json.12.0.3.nupkg	Transitive	N/A	❌
CVE-2022-1941	Medium	5.5	google.protobuf.3.19.4.nupkg	Transitive	N/A	❌

Details

WS-2022-0161

Vulnerable Library - newtonsoft.json.12.0.3.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.12.0.3.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/12.0.3/newtonsoft.json.12.0.3.nupkg

Dependency Hierarchy:

• akka.persistence.query.sql.1.4.39.nupkg (Root Library)
  • akka.persistence.1.4.39.nupkg
    • akka.1.4.39.nupkg
      • ❌ newtonsoft.json.12.0.3.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Improper Handling of Exceptional Conditions in Newtonsoft.Json.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed. Exploiting this vulnerability results in Denial Of Service (DoS), and it is exploitable when an attacker sends 5 requests that cause SOE in time frame of 5 minutes. This vulnerability affects Internet Information Services (IIS) Applications.

Publish Date: 2022-06-22

URL: WS-2022-0161

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-22

Fix Resolution: Newtonsoft.Json - 13.0.1;Microsoft.Extensions.ApiDescription.Server - 6.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-1941

Vulnerable Library - google.protobuf.3.19.4.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Dependency Hierarchy:

• akka.persistence.query.sql.1.4.39.nupkg (Root Library)
  • akka.persistence.1.4.39.nupkg
    • ❌ google.protobuf.3.19.4.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

xunit.2.4.1.nupkg: 5 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - xunit.2.4.1.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2018-8292	High	7.5	system.net.http.4.3.0.nupkg	Transitive	N/A	❌
CVE-2017-0247	High	7.5	system.net.http.4.3.0.nupkg	Transitive	N/A	❌
CVE-2017-0248	High	7.5	system.net.http.4.3.0.nupkg	Transitive	N/A	❌
CVE-2017-0249	High	7.3	system.net.http.4.3.0.nupkg	Transitive	N/A	❌
CVE-2017-0256	Medium	5.3	system.net.http.4.3.0.nupkg	Transitive	N/A	❌

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.1.nupkg (Root Library)
  • xunit.assert.2.4.1.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with Mend here

CVE-2017-0247

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.1.nupkg (Root Library)
  • xunit.assert.2.4.1.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Publish Date: 2017-05-12

URL: CVE-2017-0247

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.5.4;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

CVE-2017-0248

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.1.nupkg (Root Library)
  • xunit.assert.2.4.1.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Publish Date: 2017-05-12

URL: CVE-2017-0248

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1, 4.3.1;System.Net.Http - 4.1.2, 4.3.2;System.Net.Http.WinHttpHandler - 4.0.2, 4.3.1;System.Net.Security - 4.0.1, 4.3.1;System.Net.WebSockets.Client - 4.0.1, 4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4, 1.1.3

Step up your Open Source Security Game with Mend here

CVE-2017-0249

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.1.nupkg (Root Library)
  • xunit.assert.2.4.1.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0249

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.3.1;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

CVE-2017-0256

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.1.nupkg (Root Library)
  • xunit.assert.2.4.1.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0256

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0256

Release Date: 2017-05-12

Fix Resolution: Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.1.3,1.0.4;System.Net.Http - 4.1.2,4.3.2;Microsoft.AspNetCore.Mvc.Razor - 1.1.3,1.0.4;System.Net.Http.WinHttpHandler - 4.0.2,4.3.0-preview1-24530-04;System.Net.Security - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;System.Text.Encodings.Web - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3;System.Net.WebSockets.Client - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

Add additional columns

Customize the table as required

oracle.manageddataaccess.21.8.0.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - oracle.manageddataaccess.21.8.0.nupkg

Oracle Data Provider for .NET, Managed Driver for Oracle Database.

Library home page: https://api.nuget.org/packages/oracle.manageddataaccess.21.8.0.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/oracle.manageddataaccess/21.8.0/oracle.manageddataaccess.21.8.0.nupkg,/racle.manageddataaccess/21.8.0/oracle.manageddataaccess.21.8.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (oracle.manageddataaccess.21.8.0.nupkg version)	Remediation Available
CVE-2023-21893	High	7.5	oracle.manageddataaccess.21.8.0.nupkg	Direct	Oracle.ManagedDataAccess - 21.9.0, Oracle.ManagedDataAccess.Core - 3.21.90	❌

Details

CVE-2023-21893

Vulnerable Library - oracle.manageddataaccess.21.8.0.nupkg

Oracle Data Provider for .NET, Managed Driver for Oracle Database.

Library home page: https://api.nuget.org/packages/oracle.manageddataaccess.21.8.0.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/oracle.manageddataaccess/21.8.0/oracle.manageddataaccess.21.8.0.nupkg,/racle.manageddataaccess/21.8.0/oracle.manageddataaccess.21.8.0.nupkg

Dependency Hierarchy:

• ❌ oracle.manageddataaccess.21.8.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Publish Date: 2023-01-18

URL: CVE-2023-21893

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5pm2-9mr2-3frq

Release Date: 2023-01-18

Fix Resolution: Oracle.ManagedDataAccess - 21.9.0, Oracle.ManagedDataAccess.Core - 3.21.90

Step up your Open Source Security Game with Mend here

Redundant line: var timestamp = reader.GetInt64(TimestampIndex);

https://github.com/ismaelhamed/akka.persistence.oracle/blob/master/src/Akka.Persistence.Oracle/Journal/OracleQueryExecutor.cs line 182 is not used.

var timestamp = reader.GetInt64(TimestampIndex);

Possible bug ?

xunit.2.4.2.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - xunit.2.4.2.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (xunit.2.4.2.nupkg version)	Remediation Available
CVE-2018-8292	High	7.5	system.net.http.4.3.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• xunit.2.4.2.nupkg (Root Library)
  • xunit.assert.2.4.2.nupkg
    • netstandard.library.1.6.1.nupkg
      • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with Mend here

microsoft.extensions.configuration.xml.7.0.0.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - microsoft.extensions.configuration.xml.7.0.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.pkcs/7.0.0/system.security.cryptography.pkcs.7.0.0.nupkg

Found in HEAD commit: d39889d06f1374b99cf4478ccbf7c20c1f86f5fa

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (microsoft.extensions.configuration.xml.7.0.0.nupkg version)	Remediation Possible**
CVE-2023-29331	High	7.5	system.security.cryptography.pkcs.7.0.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-29331

Vulnerable Library - system.security.cryptography.pkcs.7.0.0.nupkg

Provides support for PKCS and CMS algorithms.

Commonly Used Types:
System.Security.Cryptography.Pkcs.EnvelopedCms

Library home page: https://api.nuget.org/packages/system.security.cryptography.pkcs.7.0.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.pkcs/7.0.0/system.security.cryptography.pkcs.7.0.0.nupkg

Dependency Hierarchy:

• microsoft.extensions.configuration.xml.7.0.0.nupkg (Root Library)
  • system.security.cryptography.xml.7.0.0.nupkg
    • ❌ system.security.cryptography.pkcs.7.0.0.nupkg (Vulnerable Library)

Found in HEAD commit: d39889d06f1374b99cf4478ccbf7c20c1f86f5fa

Found in base branch: dev

Vulnerability Details

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Publish Date: 2023-06-14

URL: CVE-2023-29331

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-555c-2p6r-68mm

Release Date: 2023-06-14

Fix Resolution: Microsoft.NetCore.App.Runtime.linux-arm - 6.0.18,7.0.7, Microsoft.Windows.Compatibility - 6.0.6,7.0.3, System.Security.Cryptography.Pkcs - 6.0.3,7.0.2

Step up your Open Source Security Game with Mend here

akka.persistence.sql.testkit.1.4.45.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - akka.persistence.sql.testkit.1.4.45.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle.Tests/Akka.Persistence.Oracle.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (akka.persistence.sql.testkit.1.4.45.nupkg version)	Remediation Available
CVE-2022-1941	High	7.5	google.protobuf.3.19.4.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-1941

Vulnerable Library - google.protobuf.3.19.4.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to dependency file: /src/Benchmark/Benchmark.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Dependency Hierarchy:

• akka.persistence.sql.testkit.1.4.45.nupkg (Root Library)
  • akka.persistence.query.sql.1.4.45.nupkg
    • akka.persistence.1.4.45.nupkg
      • ❌ google.protobuf.3.19.4.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

system.text.regularexpressions.4.3.0.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (system.text.regularexpressions.4.3.0.nupkg version)	Remediation Possible**
CVE-2019-0820	High	7.5	system.text.regularexpressions.4.3.0.nupkg	Direct	System.Text.RegularExpressions - 4.3.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here

netstandard.library.1.6.0.nupkg: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - netstandard.library.1.6.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (netstandard.library.1.6.0.nupkg version)	Remediation Available
CVE-2018-8292	High	7.5	system.net.http.4.1.0.nupkg	Transitive	N/A*	❌
CVE-2019-0820	High	7.5	system.text.regularexpressions.4.3.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.1.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.1.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg

Dependency Hierarchy:

• netstandard.library.1.6.0.nupkg (Root Library)
  • ❌ system.net.http.4.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with Mend here

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/Akka.Persistence.Oracle/Akka.Persistence.Oracle.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

• netstandard.library.1.6.0.nupkg (Root Library)
  • system.xml.xdocument.4.0.11.nupkg
    • system.xml.readerwriter.4.0.11.nupkg
      • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 298ddd225c244b10db0f379f48ef0e61f83f37c7

Found in base branch: dev

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here