TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wrqf-rrrw-w3mg
Summary: Code injection in Apache Druid
Aliases: CVE-2021-25646
Severity: HIGH
CWE: CWE-732
Published: 2021-06-16T17:40:47Z

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Vulnerability: GHSA-g23v-p5jq-jvh4
Summary: Infinite loop in Apache CFX
Aliases: CVE-2021-30468
Severity: HIGH
CWE: CWE-400, CWE-835
Published: 2022-01-06T18:37:14Z

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Vulnerability: GHSA-3pp3-77j6-8ph6
Summary: Missing Authentication for Critical Function in Apache NiFi
Aliases: CVE-2020-9487
Severity: HIGH
CWE: CWE-306
Published: 2022-01-06T20:41:04Z

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Vulnerability: GHSA-75xc-qvxh-27f8
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Aliases: CVE-2021-31403
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:51:06Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

- https://vaadin.com/security/cve-2021-31403
Vulnerability: GHSA-7q9c-h23x-65fq
Summary: Moderate severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2016-4977
Severity: HIGH
Published: 2018-10-18T18:06:22Z

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
Vulnerability: GHSA-p5gm-fgfx-hr7h
Summary: Gadget chain attack in Nippy
Aliases: CVE-2020-24164
Severity: HIGH
CWE: CWE-502
Published: 2022-02-10T20:55:10Z

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Vulnerability: GHSA-6x48-j4x4-cqw3
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-8009
Severity: HIGH
CWE: CWE-22
Published: 2018-12-21T17:50:29Z

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Vulnerability: GHSA-j53j-gmr9-h8g3
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-8017
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-17T15:50:31Z

In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Vulnerability: GHSA-gg9m-fj3v-r58c
Summary: REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
Aliases: CVE-2017-9805
Severity: HIGH
CWE: CWE-502
Published: 2018-10-16T19:37:56Z

The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Vulnerability: GHSA-227w-wv4j-67h4
Summary: Class Loading Vulnerability in Artemis
Severity: HIGH
CWE: CWE-653, CWE-501
Published: 2022-02-09T22:30:30Z

### Impact
This affects all Artemis users who test Java assignments. **Ares is not required.**
Students code that gets automatically tested can run arbitrary code in the container,
or arbitrary code on the machine of an assessor in case of manual correction.

### Patches
The problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:

```xml
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.0.0</version>
    <executions>
        <execution>
            <id>enforce-no-student-code-in-trusted-packages</id>
            <phase>process-classes</phase>
            <goals>
                <goal>enforce</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <rules>
            <requireFilesDontExist>
                <files>
                    <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->
                </files>
            </requireFilesDontExist>
        </rules>
    </configuration>
</plugin>
```

This fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion https://github.com/ls1intum/Ares/discussions
* Open an issue in https://github.com/ls1intum/Ares/issues
* Email us, see https://github.com/ls1intum/Ares/security/policy

### References
See the assignment of Julius that passes the tests in TUM Artemis course: "Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests" (if that still exists in 2022).

Also see #15 for almost the same problem.
Vulnerability: GHSA-hxp5-8pgq-mgv9
Summary: Missing Authentication for Critical Function in Apache Calcite
Aliases: CVE-2020-13955
Severity: MODERATE
CWE: CWE-295
Published: 2021-04-22T16:14:14Z

"HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses this method internally to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore."
Vulnerability: GHSA-rf7q-xqm3-6923
Summary: Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML
Aliases: CVE-2016-5395
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-17T17:21:37Z

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.
Vulnerability: GHSA-5h26-c766-g93v
Summary: Cross-Site Scripting
Aliases: CVE-2021-20293
Severity: HIGH
CWE: CWE-79
Published: 2021-06-15T15:59:27Z

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerability: GHSA-j7c3-96rf-jrrp
Summary: Critical vulnerability in log4j may affect generated PEAR projects
Severity: CRITICAL
Published: 2021-12-16T21:01:51Z

### Impact
UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.

### Patches
- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version >= `2.0.1` for generating new PEAR projects.

- Existing maven PEAR projects can be patched by manually upgrading to `log4j` >= `2.16.0` in `pom.xml`.


### References
https://www.lunasec.io/docs/blog/log4j-zero-day/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/averbis/pear-archetype/issues
Vulnerability: GHSA-f8vc-wfc8-hxqh
Summary: Improper Privilege Management in Apache Hadoop
Aliases: CVE-2020-9492
Severity: HIGH
CWE: CWE-863, CWE-269
Published: 2022-02-09T22:17:38Z

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Vulnerability: GHSA-rcpf-vj53-7h2m
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1257
Severity: MODERATE
Published: 2018-10-17T20:02:20Z

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Vulnerability: GHSA-4w4p-xwrr-9crh
Summary: Injection in Apache Syncope
Aliases: CVE-2020-1961
Severity: HIGH
CWE: CWE-74
Published: 2021-06-16T17:18:49Z

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
Vulnerability: GHSA-fv3m-xhqw-9m79
Summary: ballcat-codegen template engine remote code execution injection
Aliases: CVE-2022-24881
Severity: HIGH
CWE: CWE-78
Published: 2022-04-27T21:05:15Z

### Impact
Ballcat Codegen provides the function of online editing code to generate templates.
In version < 1.0.0.beta.2, since Velocity and freemarker templates are introduced but input verification is not done, attackers can implement remote code execution through malicious code injection of the template engine.

### Patches
The fault is rectified and needs to be upgraded to the latest version.
Vulnerability: GHSA-q5r4-cfpx-h6fh
Summary: Improper Handling of Length Parameter Inconsistency in Apache Ant
Aliases: CVE-2021-36373
Severity: MODERATE
CWE: CWE-130
Published: 2021-08-02T16:56:17Z

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Vulnerability: GHSA-f5f4-m7qp-w6gc
Summary: Cross-site Scripting in Jooby
Aliases: CVE-2019-15477
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-27T17:40:33Z

Jooby before 1.6.4 has XSS via the default error handler.
Vulnerability: GHSA-v525-c3g5-cg9p
Summary: Unsafe Deserialization that can Result in Code Execution
Aliases: CVE-2020-36282
Severity: HIGH
CWE: CWE-502
Published: 2021-12-10T17:15:49Z

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Vulnerability: GHSA-p93c-h8qm-7256
Summary: Improper escaping in XWiki Platform
Aliases: CVE-2020-13654
Severity: HIGH
CWE: CWE-116
Published: 2022-02-09T22:32:29Z

XWiki Platform before 12.8 mishandles escaping in the property displayer.
Vulnerability: GHSA-wh8g-3j2c-rqj5
Summary: Serialization gadgets exploit in jackson-databind
Aliases: CVE-2020-35490
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:15:00Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-6xx3-rg99-gc3p
Summary: Timing based private key exposure in Bouncy Castle
Aliases: CVE-2020-15522
Severity: MODERATE
CWE: CWE-362, CWE-203
Published: 2021-08-13T15:22:31Z

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.2.1, BC before 1.66, BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Vulnerability: GHSA-7q4h-pj78-j7vg
Summary: Authorization service vulnerable to DDos attacks in Apache CFX
Aliases: CVE-2021-22696
Severity: HIGH
CWE: CWE-918, CWE-400
Published: 2021-05-13T22:31:05Z

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
Vulnerability: GHSA-7xr3-rgwh-pw22
Summary: Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Aliases: CVE-2018-8030
Severity: HIGH
CWE: CWE-20
Published: 2018-10-16T19:50:39Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Vulnerability: GHSA-4fq3-mr56-cg6r
Summary: High severity vulnerability that affects org.springframework.data:spring-data-commons
Aliases: CVE-2018-1273
Severity: HIGH
CWE: CWE-94
Published: 2018-10-17T17:23:24Z

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Vulnerability: GHSA-c566-2grg-mjwg
Summary: Serialization vulnerability in Apache Tapestry
Aliases: CVE-2020-17531
Severity: CRITICAL
CWE: CWE-502
Published: 2022-02-09T22:50:50Z

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Vulnerability: GHSA-9vjp-v76f-g363
Summary:  SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
Aliases: CVE-2021-37137
Severity: HIGH
CWE: CWE-400
Published: 2021-09-09T17:11:31Z

### Impact
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.

This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

### Impact

All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.

### References
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185
Vulnerability: GHSA-6vvh-5794-vpmj
Summary: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Aliases: CVE-2020-35216
Severity: MODERATE
CWE: CWE-362
Published: 2021-12-17T20:40:58Z

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Vulnerability: GHSA-q3jg-4c82-j4xh
Summary: Moderate severity vulnerability that affects org.springframework.credhub:spring-credhub-core
Aliases: CVE-2018-15795
Severity: HIGH
CWE: CWE-338
Published: 2018-11-29T21:30:30Z

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
Vulnerability: GHSA-f4cj-3q3h-884r
Summary: Partial authorization bypass on document save in xwiki-platform
Aliases: CVE-2022-23615
Severity: MODERATE
CWE: CWE-863
Published: 2022-02-09T21:21:53Z

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right (EDIT right before XWiki 7.4) can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. It has been patched in XWiki 13.0. The only workaround is to give SCRIPT right only to trusted users.
Vulnerability: GHSA-r58x-wjg8-63m9
Summary: Denial of Service in Apache James
Aliases: CVE-2021-40110
Severity: HIGH
Published: 2022-01-08T00:40:30Z

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
Vulnerability: GHSA-xxfh-x98p-j8fr
Summary: Remote code injection in Log4j (through pax-logging-log4j2)
Severity: CRITICAL
Published: 2021-12-10T20:15:37Z

### Impact
Remote Code Execution.

### Patches
Users of pax-logging 1.11.9 should update to 1.11.10.
Users of pax-logging 2.0.10 should update to 2.0.11.

### Workarounds
Set system property `-Dlog4j2.formatMsgNoLookups=true`

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
Vulnerability: GHSA-jv74-f9pj-xp3f
Summary: Apache Camel's Mail is vulnerable to path traversal
Aliases: CVE-2018-8041
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-16T23:07:57Z

Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
Vulnerability: GHSA-p5hg-3xm3-gcjg
Summary: Spring Framework allows applications to expose STOMP over WebSocket endpoints
Aliases: CVE-2018-1270
Severity: CRITICAL
CWE: CWE-358, CWE-94
Published: 2018-10-17T20:05:59Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Vulnerability: GHSA-h3hw-g4hm-7gr4
Summary: SQL injection without credentials in ming-soft MCMS
Aliases: CVE-2020-23262
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-09T22:18:13Z

An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
Vulnerability: GHSA-4r7g-7cpj-5jr7
Summary: Moderate severity vulnerability that affects org.apache.qpid:qpid-broker
Aliases: CVE-2017-15701
Severity: HIGH
CWE: CWE-400
Published: 2018-10-19T16:41:15Z

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate.  Older AMQP protocols are not affected.
Vulnerability: GHSA-q42q-523g-3fwv
Summary: Cross-Site Request Forgery
Aliases: CVE-2020-7780
Severity: MODERATE
CWE: CWE-352
Published: 2022-02-09T23:06:40Z

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Vulnerability: GHSA-8674-26jc-wh98
Summary: Improper Access Control in infinispan-server-runtime
Aliases: CVE-2020-25711
Severity: MODERATE
CWE: CWE-269, CWE-862
Published: 2022-02-09T22:56:32Z

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Vulnerability: GHSA-wc73-w5r9-x9pc
Summary: Cross-site Scripting in XXL-JOB
Aliases: CVE-2020-29204
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-12T16:41:36Z

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
Vulnerability: GHSA-2fw5-rvf2-jq56
Summary: High severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2014-0002
Severity: HIGH
Published: 2018-10-16T23:13:26Z

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability: GHSA-gv87-q66h-4277
Summary: Command injection in itext7-core
Aliases: CVE-2021-43113
Severity: CRITICAL
CWE: CWE-77
Published: 2021-12-16T00:02:15Z

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Vulnerability: GHSA-hrxv-694f-22g3
Summary: Exposure of Sensitive Information to an Unauthorized Actor in LemMinX
Aliases: CVE-2022-0672
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-19T00:01:28Z

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.
Vulnerability: GHSA-5mg8-w23w-74h3
Summary: Information Disclosure in Guava
Aliases: CVE-2020-8908
Severity: LOW
CWE: CWE-732, CWE-200, CWE-173
Published: 2021-03-25T17:04:19Z

A temp directory creation vulnerability exists in all Guava versions allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method
Vulnerability: GHSA-gvxv-5fp2-358q
Summary: Incorrect Resource Transfer Between Spheres in eclipse-wtp
Aliases: CVE-2019-10753
Severity: MODERATE
CWE: CWE-669
Published: 2019-09-11T23:08:57Z

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
Vulnerability: GHSA-qhxh-9hhx-6p7v
Summary: Prototype Pollution in GraphHopper
Aliases: CVE-2021-23408
Severity: MODERATE
CWE: CWE-1321
Published: 2021-08-02T16:59:35Z

This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Vulnerability: GHSA-fvx3-g627-phm2
Summary: Moderate severity vulnerability that affects com.ctrip.framework.apollo:apollo
Aliases: CVE-2019-10686
Severity: CRITICAL
CWE: CWE-918
Published: 2019-04-18T14:27:42Z

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
Vulnerability: GHSA-gx3f-hq7p-8fxv
Summary: Code injection in spring-cloud-netflix-hystrix-dashboard
Aliases: CVE-2021-22053
Severity: HIGH
CWE: CWE-94
Published: 2021-11-23T17:53:33Z

Applications using the `spring-cloud-netflix-hystrix-dashboard` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Vulnerability: GHSA-h7v4-7xg3-hxcc
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39147
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:47:46Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39147](https://x-stream.github.io/CVE-2021-39147.html).

### Credits
wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-7r82-7xv7-xcpj
Summary: Cross-site scripting in Apache HttpClient
Aliases: CVE-2020-13956
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-03T23:40:23Z

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Vulnerability: GHSA-mw3r-pfmg-xp92
Summary: Improper Restriction of Recursive Entity References in Apache XMLBeans
Aliases: CVE-2021-23926
Severity: CRITICAL
CWE: CWE-776
Published: 2021-06-16T17:37:11Z

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Vulnerability: GHSA-9wx7-jrvc-28mm
Summary: Signature verification vulnerability in Stark Bank ecdsa libraries
Severity: HIGH
CWE: CWE-347
Published: 2021-11-08T21:51:18Z

An attacker can forge signatures on arbitrary messages that will verify for any public key. This may allow attackers to authenticate as any user within the Stark Bank platform, and bypass signature verification needed to perform operations on the platform, such as send payments and transfer funds. Additionally, the ability for attackers to forge signatures may impact other users and projects using these libraries in different and unforeseen ways.
Vulnerability: GHSA-p2rp-cmjq-r7wm
Summary: Shell command injection in Apache Syncope
Aliases: CVE-2020-11977
Severity: HIGH
CWE: CWE-78
Published: 2021-06-16T17:19:12Z

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Vulnerability: GHSA-gq28-h5vg-8prx
Summary: Privilege escalation in spring security
Aliases: CVE-2021-22112
Severity: HIGH
CWE: CWE-269
Published: 2021-05-10T15:22:39Z

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Vulnerability: GHSA-qmfc-6www-fjqw
Summary: Code injection in Apache Dubbo
Aliases: CVE-2021-30181
Severity: CRITICAL
CWE: CWE-94
Published: 2022-03-18T17:57:04Z

Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Vulnerability: GHSA-mwm4-5qwr-g9pf
Summary: Keycloak is vulnerable to IDN homograph attack
Severity: LOW
CWE: CWE-284
Published: 2022-04-28T21:00:31Z

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.
Vulnerability: GHSA-6fpp-rgj9-8rwc
Summary: Deserialization of untrusted data in FasterXML jackson-databind
Aliases: CVE-2019-14379
Severity: CRITICAL
CWE: CWE-915
Published: 2019-08-01T19:18:00Z

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Vulnerability: GHSA-m9jm-rhrm-gcxj
Summary: Path traversal in org.springframework.integration:spring-integration-zip
Aliases: CVE-2018-1261
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-18T18:05:46Z

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Vulnerability: GHSA-84p2-vf58-xhxv
Summary: Billion laughs attack in c3p0
Aliases: CVE-2019-5427
Severity: HIGH
CWE: CWE-776
Published: 2019-04-23T16:03:18Z

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Vulnerability: GHSA-f4jh-ww96-9h9j
Summary: Netflix/Priam: Temporary Directory Information Disclosure
Aliases: CVE-2021-28100
Severity: MODERATE
CWE: CWE-377
Published: 2021-03-30T16:23:12Z

### Impact

When `File.createTempFile` creates a file, the permissions on that file are -rw-r--r--. This means that other users can read the contents of these files after they are written, although they can not modify the contents. This allows for local information disclosure if these files contain sensitive information.

Vulnerable locations:
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/backup/MetaData.java#L106-L111
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/identity/DoubleRing.java#L109-L118
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/restore/PostRestoreHook.java#L80-L86

---

The custom CodeQL queries leveraged to find these this as well as their results can be found here:

https://lgtm.com/query/1543383251073929777/
https://lgtm.com/query/3142895023158674709/

## Official Disclosure

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md

## Fix

There are no fixed versions.
Vulnerability: GHSA-668q-qrv7-99fm
Summary: Deserialization of Untrusted Data in logback
Aliases: CVE-2021-42550
Severity: MODERATE
CWE: CWE-502
Published: 2021-12-17T20:00:50Z

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Vulnerability: GHSA-8vfm-4388-6rpc
Summary: Apache is vulnerable to XXE in XSD validation processor
Aliases: CVE-2018-8027
Severity: CRITICAL
CWE: CWE-611
Published: 2018-10-16T23:06:25Z

Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Vulnerability: GHSA-jc35-q369-45pv
Summary: Remote code execution in Apache Struts
Aliases: CVE-2020-17530
Severity: CRITICAL
CWE: CWE-917, CWE-94
Published: 2022-02-09T22:51:56Z

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Vulnerability: GHSA-x588-g38j-f672
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36737
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-08T00:46:20Z

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
Vulnerability: GHSA-p9cf-qjxq-vxw6
Summary: Privilege Context Switching Error in wildlfy
Aliases: CVE-2020-1719
Severity: MODERATE
CWE: CWE-270
Published: 2021-06-08T18:52:27Z

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
Vulnerability: GHSA-6pcc-3rfx-4gpm
Summary: Dom4j contains a XML Injection vulnerability
Aliases: CVE-2018-1000632
Severity: HIGH
CWE: CWE-91
Published: 2018-10-16T17:01:25Z

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts.  To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.
Vulnerability: GHSA-9279-7hph-r3xw
Summary: Buffer Overflow in Apache Mina SSHD
Aliases: CVE-2021-30129
Severity: HIGH
CWE: CWE-772
Published: 2021-08-02T16:54:09Z

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Vulnerability: GHSA-qq48-m4jx-xqh8
Summary: "Deserialization errors in MyBatis"
Aliases: CVE-2020-26945
Severity: HIGH
CWE: CWE-502
Published: 2021-04-22T16:14:38Z

MyBatis before 3.5.6 mishandles deserialization of object streams leading to potential cache poisoning.
Vulnerability: GHSA-m394-8rww-3jr7
Summary: DOS vulnerability for Quoted Quality CSV headers
Aliases: CVE-2020-27223
Severity: MODERATE
CWE: CWE-400
Published: 2021-03-10T03:46:47Z

### Impact
When Jetty handles a request containing request headers with a large number of “quality” (i.e. q) parameters (such as what are seen on the `Accept`, `Accept-Encoding`, and `Accept-Language` request headers), the server may enter a denial of service (DoS) state due to high CPU usage while sorting the list of values based on their quality values.  A single request can easily consume minutes of CPU time before it is even dispatched to the application.

The only features within Jetty that can trigger this behavior are:

- Default Error Handling - the `Accept` request header with the `QuotedQualityCSV` is used to determine what kind of content to send back to the client (html, text, json, xml, etc)
- `StatisticsServlet` - uses the `Accept` request header with the `QuotedQualityCSV` to determine what kind of content to send back to the client (xml, json, text, html, etc)
- `HttpServletRequest.getLocale()` - uses the `Accept-Language` request header with the `QuotedQualityCSV` to determine which “preferred” language is returned on this call.
- `HttpservletRequest.getLocales()` - is similar to the above, but returns an ordered list of locales based on the quality values on the `Accept-Language` request header.
- `DefaultServlet` - uses the `Accept-Encoding` request header with the `QuotedQualityCSV` to determine which kind of pre-compressed content should be sent back for static content (content that is not matched against a url-pattern in your web app)

### Versions
`QuotedQualityCSV` was introduced to Jetty 9.3.9.v20160517 and the bug that introduced the vulnerability was in 9.4.6.v20170531. 

Currently, known vulnerable versions include:

- 9.4.6.v20170531 thru to 9.4.36.v20210114
- 10.0.0
- 11.0.0

### Workarounds

Quality ordered values are used infrequently by jetty so they can be avoided by:

 * Do not use the default error page/handler.
 * Do not deploy the `StatisticsServlet` exposed to the network
 * Do not call `getLocale` API
 * Do not enable precompressed static content in the `DefaultServlet` 

### Patches

All patches are available for download from the Eclipse Jetty website at [https://www.eclipse.org/jetty/download.php](https://www.eclipse.org/jetty/download.php)
- 9.4.37.v20210219 and greater
- 10.0.1 and greater 
- 11.0.1 and greater
Vulnerability: GHSA-gx6h-936c-vrrr
Summary: Cross site scripting in registration template in xwiki-platform
Aliases: CVE-2022-23622
Severity: HIGH
CWE: CWE-79
Published: 2022-02-09T23:25:44Z

### Impact

We found a possible XSS vector in the `registerinline.vm` template related to the `xredirect` hidden field. 
This template is only used in the following conditions:
  - the wiki must be open to registration for anyone
  - the wiki must be closed to view for Guest users (more specifically the XWiki.Registration page must be forbidden in View for guest user)

A way to obtain the second condition is when administrators checked the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights.

### Patches

The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.

### Workarounds

There are two main ways for protecting against this vulnerability, the easiest and the best one is by applying a patch in the `registerinline.vm` template, the patch consists in checking the value of the xredirect field to ensure it matches the following:
```
<input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />
```

If for some reason it's not possible to patch this file, another workaround is to ensure "Prevent unregistered users from viewing pages, regardless of the page rights" is not checked in the rights and apply a better right scheme using groups and rights on spaces. 

### References

https://jira.xwiki.org/browse/XWIKI-19291

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-v3vf-2r98-xw8w
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-1322
Severity: MODERATE
CWE: CWE-200
Published: 2018-11-06T23:17:25Z

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.
Vulnerability: GHSA-w4g2-9hj6-5472
Summary: Moderate severity vulnerability that affects com.rabbitmq:amqp-client and org.springframework.amqp:spring-amqp
Aliases: CVE-2018-11087
Severity: MODERATE
CWE: CWE-295
Published: 2018-10-18T18:06:08Z

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Vulnerability: GHSA-hw7r-qrhp-5pff
Summary: Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Severity: MODERATE
Published: 2021-08-30T16:16:46Z

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.

- https://vaadin.com/security/cve-2021-33605
Vulnerability: GHSA-2cxf-6567-7pp6
Summary: Local Information Disclosure Vulnerability
Aliases: CVE-2021-21331
Severity: LOW
CWE: CWE-379, CWE-378
Published: 2021-03-03T23:01:17Z

### Impact
Local information disclosure of sensitive information downloaded via the API using the API Client. 

### Finding
The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system.

Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. 

This vulnerability was found due to [this query](https://lgtm.com/query/8938575359870595124/) that [Jonathan Leitschuh](https://github.com/JLLeitschuh) contributed to the Semmle QL project.

### Patches
This issue has been patched in [version 1.0.0-beta.9](https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9). 

See also [Remove unused downloadFile helpers](https://github.com/DataDog/datadog-api-client-java/pull/637). 

### Workarounds
The recommended workaround is to specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.

### References
* [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)
* [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [DataDog/datadog-api-client-java](https://github.com/DataDog/datadog-api-client-java)	
* Email us at [security@datadoghq.com](mailto:security@datadoghq.com)
Vulnerability: GHSA-48rw-j489-928m
Summary: Signature wrapping vulnerability in Spring Security
Aliases: CVE-2020-5407
Severity: HIGH
CWE: CWE-347
Published: 2020-06-05T16:13:29Z

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Vulnerability: GHSA-8hxh-r6f7-jf45
Summary: Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Severity: LOW
CWE: CWE-400
Published: 2020-10-16T17:03:43Z

### Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM.  It does not affect http4s servers, other client backends, or clients that speak only to trusted servers.  This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by [CVE-2020-11612](https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897).

### Patches
Upgrade to http4s-async-http-client >= 0.21.8.  All 1.0 milestones are also safe.

### Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:

```scala
libraryDependencies ++= Seq(
  "io.netty" %  "netty-codec"         % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-codec-socks"   % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler-proxy" % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-common"        % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-transport"     % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler"       % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-resolver-dns"  % "4.1.53.Final" % Runtime
)
```

### References
* https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897
* https://github.com/http4s/http4s/issues/3681

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s](https://github.com/http4s/http4s/issues/new)
* Contact a maintainer privately per [http4s' security policy](https://github.com/http4s/http4s/blob/master/SECURITY.md#reporting-a-vulnerability)
Vulnerability: GHSA-6gf2-pvqw-37ph
Summary: Log entry injection in Spring Framework
Aliases: CVE-2021-22060
Severity: MODERATE
Published: 2022-01-12T23:04:06Z

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.