azure-identity-1.0.6.jar: 11 vulnerabilities (highest severity is: 9.8) #590
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This module contains client library for Microsoft Azure Identity.
Library home page: https://github.com/Azure/azure-sdk-for-java
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - nimbus-jose-jwt-6.0.1.jar
Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)
Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Publish Date: 2019-10-15
URL: CVE-2019-17195
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195
Release Date: 2019-10-15
Fix Resolution (com.nimbusds:nimbus-jose-jwt): 7.8.1
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.7
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - gson-2.8.6.jar
Gson JSON library
Library home page: https://github.com/google/gson
Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-processors/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.
Publish Date: 2021-10-11
URL: WS-2021-0419
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2021-10-11
Fix Resolution (com.google.code.gson:gson): 2.8.9
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - gson-2.8.6.jar
Gson JSON library
Library home page: https://github.com/google/gson
Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-processors/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
Publish Date: 2022-05-01
URL: CVE-2022-25647
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647`
Release Date: 2022-05-01
Fix Resolution (com.google.code.gson:gson): 2.8.9
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - nimbus-jose-jwt-6.0.1.jar
Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)
Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
Publish Date: 2024-02-11
URL: CVE-2023-52428
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428
Release Date: 2024-02-11
Fix Resolution (com.nimbusds:nimbus-jose-jwt): 9.37.2
Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - json-smart-2.3.jar
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
Library home page: http://www.minidev.net/
Path to dependency file: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-service/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-nar/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-nar/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml,/nifi-nar-bundles/nifi-hadoop-libraries-bundle/nifi-hadoop-libraries-nar/pom.xml,/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml,/nifi-toolkit/nifi-toolkit-admin/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Json-smart is a performance focused, JSON processor lib.
When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.
It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
Publish Date: 2023-03-13
URL: CVE-2023-1370
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
Release Date: 2023-03-22
Fix Resolution (net.minidev:json-smart): 2.4.9
Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - commons-codec-1.11.jar
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Path to dependency file: /nifi-nar-bundles/nifi-gcp-bundle/nifi-gcp-nar/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar,/home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.
Publish Date: 2019-05-20
URL: WS-2019-0379
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2019-05-20
Fix Resolution (commons-codec:commons-codec): 1.13
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - json-smart-2.3.jar
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
Library home page: http://www.minidev.net/
Path to dependency file: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-hive-bundle/nifi-hive_1_1-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-service/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-nar/pom.xml,/nifi-nar-bundles/nifi-hive-bundle/nifi-hive-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-hwx-schema-registry-bundle/nifi-hwx-schema-registry-nar/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml,/nifi-nar-bundles/nifi-hadoop-libraries-bundle/nifi-hadoop-libraries-nar/pom.xml,/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml,/nifi-toolkit/nifi-toolkit-admin/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Publish Date: 2021-02-23
URL: CVE-2021-27568
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2021-02-23
Fix Resolution (net.minidev:json-smart): 2.3.1
Direct dependency fix Resolution (com.azure:azure-identity): 1.12.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - azure-identity-1.0.6.jar
This module contains client library for Microsoft Azure Identity.
Library home page: https://github.com/Azure/azure-sdk-for-java
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Publish Date: 2024-06-11
URL: CVE-2024-35255
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-m5vv-6r4h-3vj9
Release Date: 2024-06-11
Fix Resolution: 1.12.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - nanohttpd-2.3.1.jar
NanoHttpd is a light-weight HTTP server designed for embedding in other applications.
Library home page: http://www.nanohttpd.org
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-graph-authorizer/pom.xml,/nifi-nar-bundles/nifi-azure-bundle/nifi-azure-nar/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. Workaround: Manually specifying the -Djava.io.tmpdir= argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue.
Publish Date: 2022-05-01
URL: CVE-2022-21230
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Vulnerable Library - httpclient-4.5.jar
Apache HttpComponents Client
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.
Publish Date: 2017-01-21
URL: WS-2017-3734
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803
Release Date: 2017-01-21
Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.3
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - httpclient-4.5.jar
Apache HttpComponents Client
Path to dependency file: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-azure-bundle/nifi-azure-processors/pom.xml
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Publish Date: 2020-12-02
URL: CVE-2020-13956
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956
Release Date: 2020-12-02
Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.13
Direct dependency fix Resolution (com.azure:azure-identity): 1.0.9
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: