Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 20 vulnerabilities #2610

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

kenjitm
Copy link
Contributor

@kenjitm kenjitm commented Sep 18, 2024

snyk-top-banner

Snyk has created this PR to fix 20 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • marlo-parent/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
high severity XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-2812975
  670   org.hibernate:hibernate-core:
4.3.5.Final -> 5.1.17.Final
Major version upgrade Reachable No Known Exploit
critical severity Directory Traversal
SNYK-JAVA-ORGAPACHESHIRO-5804850
  640   org.apache.shiro:shiro-spring:
1.7.1 -> 1.13.0
org.apache.shiro:shiro-web:
1.7.1 -> 1.13.0
No Path Found No Known Exploit
high severity Path Traversal
SNYK-JAVA-ORGSPRINGFRAMEWORK-7945490
  635   org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
high severity XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-174153
  600   org.hibernate:hibernate-core:
4.3.5.Final -> 5.1.17.Final
Major version upgrade No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-ORGJSON-5488379
  600   org.json:json:
20160212 -> 20231013
Major version upgrade No Path Found Proof of Concept
high severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGJSON-5962464
  600   org.json:json:
20160212 -> 20231013
Major version upgrade No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538
  585   com.fasterxml.jackson.core:jackson-core:
2.9.9 -> 2.15.0
com.fasterxml.jackson.core:jackson-databind:
2.9.10.7 -> 2.15.0
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-CHQOSLOGBACK-6094942
  505   ch.qos.logback:logback-classic:
1.1.7 -> 1.2.13
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-CHQOSLOGBACK-6094943
  505   ch.qos.logback:logback-classic:
1.1.7 -> 1.2.13
No Path Found No Known Exploit
high severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JAVA-CHQOSLOGBACK-6097492
  505   ch.qos.logback:logback-classic:
1.1.7 -> 1.2.13
No Path Found No Known Exploit
high severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JAVA-CHQOSLOGBACK-6097493
  505   ch.qos.logback:logback-classic:
1.1.7 -> 1.2.13
No Path Found No Known Exploit
high severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586
  505   org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
high severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790
  505   org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447
  495   org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217
  475   org.springframework:spring-context:
4.3.24.RELEASE -> 5.2.24.RELEASE
org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
medium severity URL Redirection to Untrusted Site ('Open Redirect')
SNYK-JAVA-ORGAPACHESHIRO-6125619
  470   org.apache.shiro:shiro-spring:
1.7.1 -> 1.13.0
org.apache.shiro:shiro-web:
1.7.1 -> 1.13.0
No Path Found No Known Exploit
medium severity Path Traversal
SNYK-JAVA-ORGAPACHESHIRO-6156658
  445   org.apache.shiro:shiro-spring:
1.7.1 -> 1.13.0
org.apache.shiro:shiro-web:
1.7.1 -> 1.13.0
No Path Found No Known Exploit
medium severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980
  420   org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749
  415   org.springframework:spring-context:
4.3.24.RELEASE -> 5.2.24.RELEASE
org.springframework:spring-webmvc:
4.3.24.RELEASE -> 6.1.13
Major version upgrade No Path Found No Known Exploit
low severity Creation of Temporary File in Directory with Insecure Permissions
SNYK-JAVA-COMGOOGLEGUAVA-5710356
  315   io.springfox:springfox-swagger2:
2.9.2 -> 2.10.0
No Path Found No Known Exploit

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Creation of Temporary File in Directory with Insecure Permissions
🦉 XML External Entity (XXE) Injection
🦉 More lessons are available in Snyk Learn

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"ch.qos.logback:logback-classic","from":"1.1.7","to":"1.2.13"},{"name":"com.fasterxml.jackson.core:jackson-core","from":"2.9.9","to":"2.15.0"},{"name":"com.fasterxml.jackson.core:jackson-databind","from":"2.9.10.7","to":"2.15.0"},{"name":"io.springfox:springfox-swagger2","from":"2.9.2","to":"2.10.0"},{"name":"org.apache.shiro:shiro-spring","from":"1.7.1","to":"1.13.0"},{"name":"org.apache.shiro:shiro-web","from":"1.7.1","to":"1.13.0"},{"name":"org.hibernate:hibernate-core","from":"4.3.5.Final","to":"5.1.17.Final"},{"name":"org.json:json","from":"20160212","to":"20231013"},{"name":"org.springframework:spring-context","from":"4.3.24.RELEASE","to":"5.2.24.RELEASE"},{"name":"org.springframework:spring-webmvc","from":"4.3.24.RELEASE","to":"6.1.13"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-CHQOSLOGBACK-6094943","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-CHQOSLOGBACK-6097493","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-CHQOSLOGBACK-6094942","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-CHQOSLOGBACK-6097492","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538","priority_score":585,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.7","score":435},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538","priority_score":585,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.7","score":435},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMGOOGLEGUAVA-5710356","priority_score":315,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"3.3","score":165},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Creation of Temporary File in Directory with Insecure Permissions"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMGOOGLEGUAVA-5710356","priority_score":315,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"3.3","score":165},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Creation of Temporary File in Directory with Insecure Permissions"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMGOOGLEGUAVA-5710356","priority_score":315,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"3.3","score":165},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Creation of Temporary File in Directory with Insecure Permissions"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMGOOGLEGUAVA-5710356","priority_score":315,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"3.3","score":165},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Creation of Temporary File in Directory with Insecure Permissions"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-DOM4J-174153","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"XML External Entity (XXE) Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-DOM4J-2812975","priority_score":670,"priority_score_factors":[{"type":"reachabilityBucket","label":"reachable","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.4","score":370},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"XML External Entity (XXE) Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-5804850","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Directory Traversal"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-6125619","priority_score":470,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.4","score":320},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"URL Redirection to Untrusted Site ('Open Redirect')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-6156658","priority_score":445,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.9","score":295},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Path Traversal"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-5804850","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Directory Traversal"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-6125619","priority_score":470,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.4","score":320},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"URL Redirection to Untrusted Site ('Open Redirect')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESHIRO-6156658","priority_score":445,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.9","score":295},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Path Traversal"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGJSON-5488379","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGJSON-5962464","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","priority_score":420,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","priority_score":495,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","priority_score":475,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","priority_score":475,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-7945490","priority_score":635,"priority_score_factors":[{"type":"freshness","label":true,"score":50},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.7","score":435},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Path Traversal"}],"prId":"ee923a60-91aa-41b4-b96a-255c3996f448","prPublicId":"ee923a60-91aa-41b4-b96a-255c3996f448","packageManager":"maven","priorityScoreList":[505,505,505,505,585,315,600,670,640,470,445,600,600,505,505,420,495,415,475,635],"projectPublicId":"9eb70693-2da3-46e8-9839-4f5e98ca756a","projectUrl":"https://app.snyk.io/org/kenjitm/project/9eb70693-2da3-46e8-9839-4f5e98ca756a?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JAVA-CHQOSLOGBACK-6094942","SNYK-JAVA-CHQOSLOGBACK-6094943","SNYK-JAVA-CHQOSLOGBACK-6097492","SNYK-JAVA-CHQOSLOGBACK-6097493","SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538","SNYK-JAVA-COMGOOGLEGUAVA-5710356","SNYK-JAVA-DOM4J-174153","SNYK-JAVA-DOM4J-2812975","SNYK-JAVA-ORGAPACHESHIRO-5804850","SNYK-JAVA-ORGAPACHESHIRO-6125619","SNYK-JAVA-ORGAPACHESHIRO-6156658","SNYK-JAVA-ORGJSON-5488379","SNYK-JAVA-ORGJSON-5962464","SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","SNYK-JAVA-ORGSPRINGFRAMEWORK-7945490"],"vulns":["SNYK-JAVA-CHQOSLOGBACK-6094943","SNYK-JAVA-CHQOSLOGBACK-6097493","SNYK-JAVA-CHQOSLOGBACK-6094942","SNYK-JAVA-CHQOSLOGBACK-6097492","SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538","SNYK-JAVA-COMGOOGLEGUAVA-5710356","SNYK-JAVA-DOM4J-174153","SNYK-JAVA-DOM4J-2812975","SNYK-JAVA-ORGAPACHESHIRO-5804850","SNYK-JAVA-ORGAPACHESHIRO-6125619","SNYK-JAVA-ORGAPACHESHIRO-6156658","SNYK-JAVA-ORGJSON-5488379","SNYK-JAVA-ORGJSON-5962464","SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","SNYK-JAVA-ORGSPRINGFRAMEWORK-7945490"],"patch":[],"isBreakingChange":true,"remediationStrategy":"vuln"}'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants