You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.7/jackson-dataformat-cbor-2.6.7.jar
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar
Dependency Hierarchy:
aws-java-sdk-core-1.11.641.jar (Root Library)
❌ ion-java-1.0.2.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then invoke certain IonValue methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the IonValue model, results in a StackOverflowError originating from the ion-java library. The patch is included in ion-java 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.
Support for reading and writing Concise Binary Object Representation
([CBOR](https://www.rfc-editor.org/info/rfc7049)
encoded data using Jackson abstractions (streaming API, data binding, tree model)
Path to dependency file: /tasks/s3/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.7/jackson-dataformat-cbor-2.6.7.jar
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Vulnerable Library - aws-java-sdk-core-1.11.641.jar
Path to dependency file: /tasks/s3/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.7/jackson-dataformat-cbor-2.6.7.jar
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-21634
Vulnerable Library - ion-java-1.0.2.jar
A Java implementation of the Amazon Ion data notation.
Library home page: https://github.com/amznlabs/ion-java/
Path to dependency file: /tasks/s3/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in
ion-java
for applications that useion-java
to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into theIonValue
model and then invoke certainIonValue
methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using theIonValue
model, results in aStackOverflowError
originating from theion-java
library. The patch is included inion-java
1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.Publish Date: 2024-01-03
URL: CVE-2024-21634
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-264p-99wq-f4j6
Release Date: 2024-01-03
Fix Resolution: com.amazon.ion:ion-java:1.10.5
CVE-2020-28491
Vulnerable Library - jackson-dataformat-cbor-2.6.7.jar
Support for reading and writing Concise Binary Object Representation ([CBOR](https://www.rfc-editor.org/info/rfc7049) encoded data using Jackson abstractions (streaming API, data binding, tree model)
Path to dependency file: /tasks/s3/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.7/jackson-dataformat-cbor-2.6.7.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Publish Date: 2021-02-18
URL: CVE-2020-28491
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491
Release Date: 2021-02-18
Fix Resolution (com.fasterxml.jackson.dataformat:jackson-dataformat-cbor): 2.11.4
Direct dependency fix Resolution (com.amazonaws:aws-java-sdk-core): 1.11.657
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: