Skip to content

SingularityBase-1.5.1-SNAPSHOT.jar: 6 vulnerabilities (highest severity is: 7.7) #287

New issue
New issue
Open
Open
SingularityBase-1.5.1-SNAPSHOT.jar: 6 vulnerabilities (highest severity is: 7.7)#287
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-for-github-com

Description

@mend-for-github-com
mend-for-github-com
opened on Jan 28, 2025
Vulnerable Library - SingularityBase-1.5.1-SNAPSHOT.jar

Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (SingularityBase version) Remediation Possible** Reachability
WS-2021-0419 High 7.7 Not Defined gson-2.8.6.jar Transitive N/A* ❌
CVE-2022-25647 High 7.7 Not Defined 1.6% gson-2.8.6.jar Transitive N/A* ❌
CVE-2024-21634 High 7.5 Not Defined 0.4% ion-java-1.0.2.jar Transitive N/A* ❌
CVE-2020-28491 High 7.5 Not Defined 0.1% jackson-dataformat-cbor-2.9.9.jar Transitive N/A* ❌
WS-2019-0379 Medium 6.5 Not Defined commons-codec-1.10.jar Transitive N/A* ❌
CVE-2020-13956 Medium 5.3 Not Defined 0.70000005% httpclient-4.5.5.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2021-0419

Vulnerable Library - gson-2.8.6.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /SingularityBase/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • jackson-datatype-protobuf-0.9.10-jackson2.9-proto3.jar
      • protobuf-java-util-3.11.4.jar
        • ❌ gson-2.8.6.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-10-11

Fix Resolution: com.google.code.gson:gson:2.8.9

CVE-2022-25647

Vulnerable Library - gson-2.8.6.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /SingularityBase/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • jackson-datatype-protobuf-0.9.10-jackson2.9-proto3.jar
      • protobuf-java-util-3.11.4.jar
        • ❌ gson-2.8.6.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Publish Date: 2022-05-01

URL: CVE-2022-25647

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.6%

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647`

Release Date: 2022-05-01

Fix Resolution: com.google.code.gson:gson:gson-parent-2.8.9

CVE-2024-21634

Vulnerable Library - ion-java-1.0.2.jar

A Java implementation of the Amazon Ion data notation.

Library home page: https://github.com/amznlabs/ion-java/

Path to dependency file: /SingularityMesosClient/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar,/home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • BaragonCore-0.9.0.jar
      • aws-java-sdk-core-1.11.497.jar
        • ❌ ion-java-1.0.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in "ion-java" for applications that use "ion-java" to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the "IonValue" model and then invoke certain "IonValue" methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the "IonValue" model, results in a "StackOverflowError" originating from the "ion-java" library. The patch is included in "ion-java" 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.

Publish Date: 2024-01-03

URL: CVE-2024-21634

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-264p-99wq-f4j6

Release Date: 2024-01-03

Fix Resolution: com.amazon.ion:ion-java:1.10.5

CVE-2020-28491

Vulnerable Library - jackson-dataformat-cbor-2.9.9.jar

Support for reading and writing Concise Binary Object Representation ([CBOR](https://www.rfc-editor.org/info/rfc7049) encoded data using Jackson abstractions (streaming API, data binding, tree model)

Library home page: http://fasterxml.com/

Path to dependency file: /EmbedSingularityExample/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.9/jackson-dataformat-cbor-2.9.9.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • BaragonCore-0.9.0.jar
      • aws-java-sdk-core-1.11.497.jar
        • ❌ jackson-dataformat-cbor-2.9.9.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Publish Date: 2021-02-18

URL: CVE-2020-28491

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491

Release Date: 2021-02-18

Fix Resolution: com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.11.4, com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.12.1

WS-2019-0379

Vulnerable Library - commons-codec-1.10.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Library home page: http://www.apache.org/

Path to dependency file: /SingularityBase/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • BaragonCore-0.9.0.jar
      • aws-java-sdk-core-1.11.497.jar
        • httpclient-4.5.5.jar
          • ❌ commons-codec-1.10.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

CVE-2020-13956

Vulnerable Library - httpclient-4.5.5.jar

Apache HttpComponents Client

Library home page: http://www.apache.org/

Path to dependency file: /SingularityS3Base/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.5/httpclient-4.5.5.jar

Dependency Hierarchy:

  • SingularityBase-1.5.1-SNAPSHOT.jar (Root Library)
    • BaragonCore-0.9.0.jar
      • aws-java-sdk-core-1.11.497.jar
        • ❌ httpclient-4.5.5.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.70000005%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-12-02

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.13;org.apache.httpcomponents:httpclient-osgi:4.5.13;org.apache.httpcomponents.client5:httpclient5:5.0.3;org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions