Skip to content

fix(security): vulnerabilities found in corda-4-6-all-in-one #2065

New issue
Jump to bottom
New issue
Jump to bottom
Open
Open
fix(security): vulnerabilities found in corda-4-6-all-in-one#2065
Assignees
alec-p-hong
Labels
CordaHacktoberfestHacktoberfest participants are welcome to take a stab at issues marked with this label.P4Priority 4: LowSecurityRelated to existing or potential security vulnerabilitiesbugSomething isn't workingdependenciesPull requests that update a dependency filegood-first-issueGood for newcomersgood-first-issue-300-advanced
@zondervancalvez

Description

@zondervancalvez
zondervancalvez
opened on Jun 1, 2022

List of vulnerabilities found in corda-4-6-all-in-one image during Azure Container scan.

VULNERABILITY ID PACKAGE NAME SEVERITY
CVE-2021-36159 apk-tools CRITICAL
CVE-2021-30139 apk-tools HIGH
CVE-2022-28391 busybox CRITICAL
CVE-2021-28831 busybox HIGH
CVE-2021-42378 busybox HIGH
CVE-2021-42379 busybox HIGH
CVE-2021-42380 busybox HIGH
CVE-2021-42381 busybox HIGH
CVE-2021-42382 busybox HIGH
CVE-2021-42383 busybox HIGH
CVE-2021-42384 busybox HIGH
CVE-2021-42385 busybox HIGH
CVE-2021-42386 busybox HIGH
CVE-2021-36222 krb5-libs HIGH
CVE-2021-39537 ncurses-libs HIGH
CVE-2021-39537 ncurses-terminfo-base HIGH
CVE-2021-28041 openssh-client HIGH
CVE-2021-41617 openssh-client HIGH
CVE-2021-28041 openssh-keygen HIGH
CVE-2021-41617 openssh-keygen HIGH
CVE-2021-3711 openssl CRITICAL
CVE-2021-23840 openssl HIGH
CVE-2021-3450 openssl HIGH
CVE-2021-3712 openssl HIGH
CVE-2022-0778 openssl HIGH
CVE-2022-28391 ssl_client CRITICAL
CVE-2021-28831 ssl_client HIGH
CVE-2021-42378 ssl_client HIGH
CVE-2021-42379 ssl_client HIGH
CVE-2021-42380 ssl_client HIGH
CVE-2021-42381 ssl_client HIGH
CVE-2021-42382 ssl_client HIGH
CVE-2021-42383 ssl_client HIGH
CVE-2021-42384 ssl_client HIGH
CVE-2021-42385 ssl_client HIGH
CVE-2021-42386 ssl_client HIGH
CVE-2022-1271 xz HIGH
CVE-2022-1271 xz-libs HIGH
CVE-2018-25032 zlib HIGH
CVE-2018-19360 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2018-19361 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2018-19362 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14379 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14540 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14892 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14893 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16335 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16942 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16943 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-17267 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-17531 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-20330 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-8840 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9546 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9547 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9548 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-12086 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2019-14439 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10672 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10673 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10968 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10969 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11111 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11112 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11113 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11619 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11620 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14060 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14061 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14062 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14195 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-24616 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-24750 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-25649 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35490 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35491 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35728 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36179 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36180 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36181 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36182 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36183 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36184 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36185 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36186 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36187 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36188 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36189 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36518 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2021-20190 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2019-14379 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14540 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14892 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-14893 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16335 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16942 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-16943 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-17267 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-17531 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-20330 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-8840 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9546 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9547 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2020-9548 com.fasterxml.jackson.core:jackson-databind CRITICAL
CVE-2019-12086 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2019-14439 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10672 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10673 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10968 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-10969 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11111 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11112 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11113 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11619 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-11620 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14060 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14061 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14062 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-14195 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-24616 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-24750 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-25649 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35490 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35491 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-35728 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36179 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36180 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36181 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36182 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36183 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36184 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36185 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36186 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36187 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36188 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36189 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2020-36518 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2021-20190 com.fasterxml.jackson.core:jackson-databind HIGH
CVE-2022-25647 com.google.code.gson:gson HIGH
CVE-2020-7692 com.google.oauth-client:google-oauth-client CRITICAL
CVE-2021-23463 com.h2database:h2 CRITICAL
CVE-2021-42392 com.h2database:h2 CRITICAL
CVE-2022-23221 com.h2database:h2 CRITICAL
CVE-2021-37136 io.netty:netty-codec HIGH
CVE-2021-37137 io.netty:netty-codec HIGH
CVE-2019-17571 log4j:log4j CRITICAL
CVE-2022-23305 log4j:log4j CRITICAL
CVE-2022-23302 log4j:log4j HIGH
CVE-2022-23307 log4j:log4j HIGH
CVE-2022-23913 org.apache.activemq:artemis-commons HIGH
CVE-2019-12402 org.apache.commons:commons-compress HIGH
CVE-2021-35515 org.apache.commons:common-compresss HIGH
CVE-2021-35516 org.apache.commons:commons-compress HIGH
CVE-2021-35517 org.apache.commons:commons-compress HIGH
CVE-2021-36090 org.apache.commons:commons-compress HIGH
CVE-2021-44228 org.apache.logging.log4j:log4j-core CRITICAL
CVE-2021-45046 org.apache.logging.log4j:log4j-core CRITICAL
CVE-2021-45105 org.apache.logging.log4j:log4j-core HIGH
CVE-2020-11989 org.apache.shiro:shiro-core CRITICAL
CVE-2020-1957 org.apache.shiro:shiro-core CRITICAL
CVE-2021-41303 org.apache.shiro:shiro-core CRITICAL
CVE-2019-12422 org.apache.shiro:shiro-core HIGH
CVE-2020-13933 org.apache.shiro:shiro-core HIGH
CVE-2021-30129 org.apache.sshd:sshd-core HIGH
CVE-2018-8014 org.apache.tomcat.embed:tomcat-embed-core CRITICAL
CVE-2020-1938 org.apache.tomcat.embed:tomcat-embed-core CRITICAL
CVE-2018-8034 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2019-0199 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2019-0232 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2019-10072 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2019-12418 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2019-17563 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2020-13934 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2020-17527 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2020-9484 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2021-25122 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2021-25329 org.apache.tomcat.embed:tomcat-embed-core HIGH
CVE-2020-13935 org.apache.tomcat.embed:tomcat-embed-websocket HIGH
CVE-2020-28052 org.bouncycastle:bcprov-jdk15on HIGH
CVE-2015-3253 org.codehaus.groovy:groovy-all CRITICAL
CVE-2020-10683 org.dom4j:dom4j CRITICAL
CVE-2020-27216 org.eclipse.jetty:jetty-http HIGH
CVE-2021-28165 org.eclipse.jetty:jetty-http HIGH
CVE-2021-28165 org.eclipse.jetty:jetty-io HIGH
CVE-2020-27216 org.eclipse.jetty:jetty-server HIGH
CVE-2021-28165 org.eclipse.jetty:jetty-server HIGH
CVE-2020-27216 org.eclipse.jetty:jetty-util HIGH
CVE-2021-28165 org.eclipse.jetty:jetty-util HIGH
CVE-2020-27216 org.eclipse.jetty:jetty-webapp HIGH
CVE-2020-25638 org.hibernate:hibernate-core HIGH
CVE-2016-2141 org.jgroups:jgroups CRITICAL
CVE-2022-0839 org.liquibase:liquibase-core CRITICAL
CVE-2022-21724 org.postgresql:postgresql CRITICAL
CVE-2022-27772 org.springframework.boot:spring-boot HIGH
CVE-2022-22965 org.springframework.boot:spring-boot-starter-web CRITICAL
CVE-2022-22965 org.springframework:spring-beans CRITICAL
CVE-2018-15756 org.springframework:spring-core HIGH
CVE-2022-22970 org.springframework:spring-core HIGH
CVE-2022-22965 org.springframework:spring-webmvc CRITICAL
CVE-2020-5398 org.springframework:spring-webmvc HIGH
CVE-2017-18640 org.yaml:snakeyaml HIGH
CVE-2017-18640 org.yaml:snakeyaml HIGH
CVE-2017-18640 org.yaml:snakeyaml HIGH
CVE-2017-18640 org.yaml:snakeyaml HIGH

Metadata

Assignees

Labels

CordaHacktoberfestHacktoberfest participants are welcome to take a stab at issues marked with this label.P4Priority 4: LowSecurityRelated to existing or potential security vulnerabilitiesbugSomething isn't workingdependenciesPull requests that update a dependency filegood-first-issueGood for newcomersgood-first-issue-300-advanced

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions