Skip to content
This repository has been archived by the owner on Jan 19, 2024. It is now read-only.

[Snyk] Fix for 20 vulnerabilities #14

Open
wants to merge 1 commit into
base: 3.8
Choose a base branch
from
Open

[Snyk] Fix for 20 vulnerabilities #14

wants to merge 1 commit into from

Conversation

svc-ast-gh-snyk5
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 XML External Entity (XXE) Injection
SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385		 org.mule.modules:mule-module-xml:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-31394		 org.mule.modules:mule-module-xml:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 629/1000
Why? Has a fix available, CVSS 8.3		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-1039798		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 519/1000
Why? Has a fix available, CVSS 6.1		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-30582		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Session Fixation
SNYK-JAVA-ORGAPACHECXF-31429		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JAVA-ORGAPACHECXF-3168313		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHECXF-31691		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-542666		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
critical severity 876/1000
Why? Mature exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409		 org.mule:mule-core:
3.8.0 -> 3.9.0
No Mature
high severity 741/1000
Why? Mature exploit, Has a fix available, CVSS 7.1		 Information Exposure
SNYK-JAVA-ORGAPACHETOMCAT-30871		 org.mule.transports:mule-transport-http:
3.8.0 -> 3.9.0
No Mature
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JAVA-ORGAPACHETOMCAT-30872		 org.mule.transports:mule-transport-http:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JAVA-ORGAPACHETOMCAT-31431		 org.mule.transports:mule-transport-http:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGMULEMODULES-31249		 org.mule.modules:mule-module-client:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-management:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-scripting:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-sxc:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-xml:
3.8.0 -> 3.9.0
org.mule.transports:mule-transport-vm:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Improper Certificate Validation
SNYK-JAVA-ORGOPENSAML-30140		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGOPENSAML-30141		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 489/1000
Why? Has a fix available, CVSS 5.5		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-30164		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-scripting:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Reflected File Download
SNYK-JAVA-ORGSPRINGFRAMEWORK-30165		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-scripting:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31323		 org.mule.modules:mule-module-client:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-management:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-scripting:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-spring-config:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-xml:
3.8.0 -> 3.9.0
org.mule.transports:mule-transport-jms:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31326		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-scripting:
3.8.0 -> 3.9.0
org.mule.modules:mule-module-spring-config:
3.8.0 -> 3.9.0
org.mule.transports:mule-transport-jms:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31327		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
org.mule.transports:mule-transport-jms:
3.8.0 -> 3.9.0
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Cross-site Scripting (XSS)
🦉 Deserialization of Untrusted Data
🦉 More lessons are available in Snyk Learn

@snyk-bot @svc-ast-gh-snyk1
fix: pom.xml to reduce vulnerabilities
bc1aecb 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385
- https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-31394
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-1039798
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-30582
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-31429
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-3168313
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-31691
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-542666
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-30871
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-30872
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-31431
- https://snyk.io/vuln/SNYK-JAVA-ORGMULEMODULES-31249
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30140
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30141
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30164
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30165
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31323
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31326
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31327
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
cla:signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@svc-ast-gh-snyk5 @snyk-bot