saikiran40cs/kiran_jbehave_cucumberformat

This is to test JBehave with Gherkin style of writing user stories

Kiran_Jbehave_CucumberFormat

This is to test JBehave with Gherkin style of writing user stories

kiran_jbehave_cucumberformat's Issues

CVE-2013-7285 Medium Severity Vulnerability detected by WhiteSource

CVE-2013-7285 - Medium Severity Vulnerability

Vulnerable Library - xstream-1.4.9.jar

XStream is a serialization library from Java objects to XML and back.

path: /root/.m2/repository/com/thoughtworks/xstream/xstream/1.4.9/xstream-1.4.9.jar

Library home page: http://x-stream.github.io/xstream

Dependency Hierarchy:

• jbehave-core-4.1.1.jar (Root Library)
  • ❌ xstream-1.4.9.jar (Vulnerable Library)

Vulnerability Details

It was found that XStream would deserialize arbitrary user-supplied XML content, representing objects of any type

Publish Date: 2015-07-16

URL: CVE-2013-7285

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://security.gentoo.org/glsa/201612-35

Release Date: 2016-12-13

Fix Resolution: All XStream users should upgrade to the latest version >= xstream-1.4.8-r1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2017-7957 High Severity Vulnerability detected by WhiteSource

CVE-2017-7957 - High Severity Vulnerability

Vulnerable Library - xstream-1.4.9.jar

XStream is a serialization library from Java objects to XML and back.

path: /root/.m2/repository/com/thoughtworks/xstream/xstream/1.4.9/xstream-1.4.9.jar

Library home page: http://x-stream.github.io/xstream

Dependency Hierarchy:

• jbehave-core-4.1.1.jar (Root Library)
  • ❌ xstream-1.4.9.jar (Vulnerable Library)

Vulnerability Details

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.

Publish Date: 2017-04-29

URL: CVE-2017-7957

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://www.securitytracker.com/id/1039499

Fix Resolution: IBM has issued a fix (8.5.3 Fix Pack 6 Interim Fix 15, 9.0.1 Feature Pack 9).

The IBM advisory is available at:

http://www-01.ibm.com/support/docview.wss?uid=swg22005235

---

Step up your Open Source Security Game with WhiteSource here