temporalio/samples-java

spring-kafka-test-2.8.11.jar: 3 vulnerabilities (highest severity is: 9.1)

mend-for-github-com opened this issue · 2 comments

mend-for-github-com commented
Vulnerable Library - spring-kafka-test-2.8.11.jar

Path to dependency file: /springboot/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.xerial.snappy/snappy-java/1.1.8.4/66f0d56454509f6e36175f2331572e250e04a6cc/snappy-java-1.1.8.4.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-kafka-test version) Remediation Possible**
CVE-2023-44981 Critical 9.1 zookeeper-3.6.3.jar Transitive 3.1.0 ✅
CVE-2023-43642 High 7.5 snappy-java-1.1.8.4.jar Transitive N/A* ❌
CVE-2023-31582 High 7.5 jose4j-0.7.8.jar Transitive 3.1.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-44981

Vulnerable Library - zookeeper-3.6.3.jar

ZooKeeper server

Library home page: http://zookeeper.apache.org

Path to dependency file: /springboot/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.zookeeper/zookeeper/3.6.3/a6e74f826db85ff8c51c15ef0fa2ea0b462aef25/zookeeper-3.6.3.jar

Dependency Hierarchy:

  • spring-kafka-test-2.8.11.jar (Root Library)
    • ❌ zookeeper-3.6.3.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.

Publish Date: 2023-10-11

URL: CVE-2023-44981

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b

Release Date: 2023-10-11

Fix Resolution (org.apache.zookeeper:zookeeper): 3.7.2

Direct dependency fix Resolution (org.springframework.kafka:spring-kafka-test): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-43642

Vulnerable Library - snappy-java-1.1.8.4.jar

snappy-java: A fast compression/decompression library

Library home page: https://github.com/xerial/snappy-java

Path to dependency file: /springboot/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.xerial.snappy/snappy-java/1.1.8.4/66f0d56454509f6e36175f2331572e250e04a6cc/snappy-java-1.1.8.4.jar

Dependency Hierarchy:

  • spring-kafka-test-2.8.11.jar (Root Library)
    • kafka-clients-3.1.2.jar
      • ❌ snappy-java-1.1.8.4.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit 9f8c3cf74 which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Publish Date: 2023-09-25

URL: CVE-2023-43642

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-55g7-9cwv-5qfv

Release Date: 2023-09-25

Fix Resolution: org.xerial.snappy:snappy-java:1.1.10.4

CVE-2023-31582

Vulnerable Library - jose4j-0.7.8.jar

The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..

Library home page: https://bitbucket.org/b_c/jose4j/

Path to dependency file: /springboot/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bitbucket.b_c/jose4j/0.7.8/34b47db4364d1916c78c3e26e419e8acbff57d80/jose4j-0.7.8.jar

Dependency Hierarchy:

  • spring-kafka-test-2.8.11.jar (Root Library)
    • kafka_2.13-3.1.2.jar
      • ❌ jose4j-0.7.8.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

Publish Date: 2023-10-25

URL: CVE-2023-31582

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then

Release Date: 2023-10-25

Fix Resolution (org.bitbucket.b_c:jose4j): 0.9.3

Direct dependency fix Resolution (org.springframework.kafka:spring-kafka-test): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

mend-for-github-com commented

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com commented

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.