Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 21 vulnerabilities #3029

Closed
wants to merge 1 commit into from
Closed

[Snyk] Fix for 21 vulnerabilities #3029

wants to merge 1 commit into from

Conversation

jumperchen
Copy link
Member

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • zktest/pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity Reachability
medium severity 101/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00046, Social Trends: No, Days since published: 609, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.67, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No No Known Exploit No Path Found
high severity 114/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0024, Social Trends: No, Days since published: 534, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.9, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No No Known Exploit No Path Found
medium severity 155/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00078, Social Trends: No, Days since published: 329, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.59, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No Proof of Concept No Path Found
medium severity 156/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00079, Social Trends: No, Days since published: 329, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.59, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No Proof of Concept No Path Found
high severity 166/1000
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, Social Trends: No, Days since published: 720, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.69, Score Version: V4		 Use After Free
SNYK-JAVA-COMGITHUBJNR-1570422		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes No Known Exploit No Path Found
low severity 45/1000
Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00206, Social Trends: No, Days since published: 1059, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Low, Package Popularity Score: 99, Impact: 4.19, Likelihood: 1.06, Score Version: V4		 Arbitrary Code Injection
SNYK-JAVA-ORGAPACHEANT-1015405		 org.codehaus.groovy:groovy-all:
1.5.6 -> 2.4.7
No No Known Exploit No Path Found
low severity 30/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.00071, Social Trends: No, Days since published: 774, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.25, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHEANT-5597835		 org.codehaus.groovy:groovy-all:
1.5.6 -> 2.4.7
No No Known Exploit No Path Found
medium severity 80/1000
Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00062, Social Trends: No, Days since published: 1200, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 1.89, Score Version: V4		 Insecure Default
SNYK-JAVA-ORGAPACHEANT-569130		 org.codehaus.groovy:groovy-all:
1.5.6 -> 2.4.7
No No Known Exploit No Path Found
medium severity 45/1000
Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00109, Social Trends: No, Days since published: 829, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.89, Score Version: V4		 Timing Attack
SNYK-JAVA-ORGBOUNCYCASTLE-1296075		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No No Known Exploit No Path Found
medium severity 103/1000
Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, Social Trends: No, Days since published: 458, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.44, Score Version: V4		 Cryptographic Issues
SNYK-JAVA-ORGBOUNCYCASTLE-2841508		 net.sf.jasperreports:jasperreports:
6.17.0 -> 6.20.1
No Proof of Concept No Path Found
critical severity 256/1000
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.02612, Social Trends: No, Days since published: 2168, Reachable: No, Transitive dependency: No, Is Malicious: No, Provider Urgency: Critical, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2.61, Score Version: V4		 Deserialization of Untrusted Data
SNYK-JAVA-ORGCODEHAUSGROOVY-31510		 org.codehaus.groovy:groovy-all:
1.5.6 -> 2.4.7
Yes No Known Exploit No Path Found
medium severity 75/1000
Why? Confidentiality impact: None, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00111, Social Trends: No, Days since published: 1209, Reachable: Yes, Transitive dependency: No, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 3.16, Score Version: V4		 Improper Input Validation
SNYK-JAVA-ORGHIBERNATE-568162		 org.hibernate:hibernate-validator:
5.3.6.Final -> 6.0.23.Final
Yes No Known Exploit Reachable
medium severity 116/1000
Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00187, Social Trends: No, Days since published: 1326, Reachable: No, Transitive dependency: No, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.94, Score Version: V4		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGHIBERNATE-569100		 org.hibernate:hibernate-validator:
5.3.6.Final -> 6.0.23.Final
Yes No Known Exploit No Path Found
high severity 180/1000
Why? Confidentiality impact: High, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, Social Trends: No, Days since published: 794, Reachable: No, Transitive dependency: No, Is Malicious: No, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.56, Score Version: V4		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGMOZILLA-1314295		 org.mozilla:rhino:
1.7R4 -> 1.7.12
No No Known Exploit No Path Found
high severity 124/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00063, Social Trends: No, Days since published: 363, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.06, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-ORGYAML-2806360		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes No Known Exploit No Path Found
low severity 61/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00102, Social Trends: No, Days since published: 356, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.59, Score Version: V4		 Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016888		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes Proof of Concept No Path Found
low severity 44/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00042, Social Trends: No, Days since published: 356, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.84, Score Version: V4		 Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016889		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes No Known Exploit No Path Found
medium severity 63/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00095, Social Trends: No, Days since published: 356, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V4		 Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016891		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes Proof of Concept No Path Found
low severity 44/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.0007, Social Trends: No, Days since published: 287, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.84, Score Version: V4		 Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3113851		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes No Known Exploit No Path Found
medium severity 232/1000
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): High, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00191, Social Trends: No, Days since published: 262, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2.37, Score Version: V4		 Arbitrary Code Execution
SNYK-JAVA-ORGYAML-3152153		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes Proof of Concept No Path Found
medium severity 86/1000
Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Adjacent, EPSS: 0.00871, Social Trends: No, Days since published: 1348, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.03, Score Version: V4		 Denial of Service (DoS)
SNYK-JAVA-ORGYAML-537645		 org.jruby:jruby-core:
1.7.27 -> 9.2.20.0
Yes Proof of Concept No Path Found

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Use After Free
🦉 Arbitrary Code Injection
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: zktest/pom.xml to reduce vulnerabilities
26b6fba 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426
- https://snyk.io/vuln/SNYK-JAVA-COMGITHUBJNR-1570422
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEANT-1015405
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEANT-5597835
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEANT-569130
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-1296075
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-2841508
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSGROOVY-31510
- https://snyk.io/vuln/SNYK-JAVA-ORGHIBERNATE-568162
- https://snyk.io/vuln/SNYK-JAVA-ORGHIBERNATE-569100
- https://snyk.io/vuln/SNYK-JAVA-ORGMOZILLA-1314295
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016888
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016889
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016891
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3113851
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3152153
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-537645
@github-actions github-actions bot added need-config.properties Pull requests that need config.properties need-release-note Pull requests that need release-note labels Aug 28, 2023
@jumperchen jumperchen closed this Aug 28, 2023
@jumperchen jumperchen deleted the snyk-fix-94865da14289f075e4f41b0ef9ac5f44 branch August 28, 2023 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
need-config.properties Pull requests that need config.properties need-release-note Pull requests that need release-note
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jumperchen @snyk-bot