TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-px4w-rcv2-6x8x
Summary: Arbitrary code execution in Apache ServiceComb java-chassis
Aliases: CVE-2020-17532
Severity: HIGH
CWE: CWE-502
Published: 2022-02-09T22:19:00Z

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution.
The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
Vulnerability: GHSA-px9h-x66r-8mpc
Summary: path traversal in Jooby
Aliases: CVE-2020-7647
Severity: MODERATE
CWE: CWE-22
Published: 2020-05-13T16:29:26Z

### Impact
Access to sensitive information available from classpath. 

### Patches
Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References

Latest 1.x version: 1.6.6

#### Arbitrary class path resource access 1
When sharing a *File System* directory as in:

``` java
assets("/static/**", Paths.get("static"));
```

The class path is also searched for the file (`org.jooby.handlers.AssetHandler.loader`):
[jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub](https://github.com/jooby-project/jooby/blob/1.x/jooby/src/main/java/org/jooby/handlers/AssetHandler.java)

``` java
  private static Loader loader(final Path basedir, final ClassLoader classloader) {
    if (Files.exists(basedir)) {
      return name -> {
        Path path = basedir.resolve(name).normalize();
        if (Files.exists(path) && path.startsWith(basedir)) {
          try {
            return path.toUri().toURL();
          } catch (MalformedURLException x) {
            // shh
          }
        }
        return classloader.getResource(name);
      };
    }
    return classloader::getResource;
  }
```

If we send `/static/WEB-INF/web.xml` it will fail to load it from the file system but will go into `classloader.getResource(name)` where name equals `/WEB-INF/web.xml` so will succeed and return the requested file. This way we can get any configuration file or even the application class files

If assets are configured for a certain extension we can still bypass it. eg:

```java
assets("/static/**/*.js", Paths.get("static"));
```

We can send:

```
http://localhost:8080/static/io/yiss/App.class.js
```

#### Arbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:

```java
assets("/static/**");
```

In this case we can traverse `static` by sending:

```
http://localhost:8080/static/..%252fio/yiss/App.class
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby](https://github.com/jooby-project/jooby/issues)
* Email us at [support@jooby.io](mailto:support@jooby.io)
Vulnerability: GHSA-269m-695x-j34p
Summary: Moderate severity vulnerability that affects org.apache.qpid:qpid-broker
Aliases: CVE-2017-15702
Severity: CRITICAL
Published: 2018-10-19T16:41:04Z

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected.
Vulnerability: GHSA-wqfh-9m4g-7x6x
Summary: Remote code execution in Apache ActiveMQ
Aliases: CVE-2020-11998
Severity: CRITICAL
CWE: CWE-94
Published: 2022-02-09T22:14:58Z

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Vulnerability: GHSA-5phw-3jrp-3vj8
Summary: Server-Side Request Forgery in Apache Solr
Aliases: CVE-2021-27905
Severity: HIGH
CWE: CWE-918
Published: 2021-05-10T15:18:06Z

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Vulnerability: GHSA-jp55-vvmf-63mv
Summary: URL Redirection to Untrusted Site ('Open Redirect')
Aliases: CVE-2022-23618
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-09T21:42:47Z

### Impact
There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.

### Patches
The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.

### Workarounds
There's no known workaround for this issue. 

### References
https://jira.xwiki.org/browse/XWIKI-10309

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-mc6h-4qgp-37qh
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14195
Severity: HIGH
CWE: CWE-502
Published: 2020-06-18T14:44:43Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Vulnerability: GHSA-p4q6-qxjx-8jgp
Summary: Directory Traversal in spring-boot-actuator-logview
Aliases: CVE-2021-21234
Severity: HIGH
CWE: CWE-22
Published: 2021-01-05T17:29:40Z

### Impact
The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory).

### Patches
The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release.

### Workarounds
There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github repo](https://github.com/lukashinsch/spring-boot-actuator-logview)
Vulnerability: GHSA-mq8p-h798-xcrp
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-15718
Severity: CRITICAL
CWE: CWE-200
Published: 2018-12-21T17:50:20Z

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Vulnerability: GHSA-gjmw-vf9h-g25v
Summary: Polymorphic typing issue
Aliases: CVE-2019-17531
Severity: CRITICAL
CWE: CWE-502
Published: 2019-11-13T00:32:38Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-wmv4-5w76-vp9g
Summary: Authorization Bypass in Spring Security
Aliases: CVE-2014-3527
Severity: CRITICAL
CWE: CWE-287
Published: 2020-09-15T20:16:22Z

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.

This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.

If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

## Mitigation
Users of affected versions should apply the following mitigation:
- Users of 3.2x should upgrade to 3.2.5 or later
- Users of 3.1.x should upgrade to 3.1.7 or later

## Credit
This issue was identified by David Ohsie and brought to our attention by the CAS Development team.
Vulnerability: GHSA-r32r-3977-cgc3
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2014-3651
Severity: HIGH
CWE: CWE-400
Published: 2018-10-18T16:50:20Z

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
Vulnerability: GHSA-9p5g-vg43-mj5r
Summary: Authenticated users can read data from other sources than intended 
Aliases: CVE-2021-36749
Severity: MODERATE
CWE: CWE-863, CWE-668
Published: 2021-09-27T20:13:25Z

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Vulnerability: GHSA-c8hm-7hpq-7jhg
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19362
Severity: HIGH
CWE: CWE-502
Published: 2019-01-04T19:07:03Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerability: GHSA-r28m-g6j9-r2h5
Summary: Information Exposure vulnerability in Eclipse Jetty
Aliases: CVE-2019-10246
Severity: MODERATE
CWE: CWE-200, CWE-213
Published: 2019-04-23T16:07:18Z

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Vulnerability: GHSA-x5x7-3v85-wpc4
Summary:  Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
Aliases: CVE-2017-9804
Severity: HIGH
CWE: CWE-20
Published: 2018-10-16T19:37:33Z

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Vulnerability: GHSA-838r-hvwh-24h8
Summary: XML Injection in Any23
Aliases: CVE-2021-38555
Severity: CRITICAL
CWE: CWE-611
Published: 2021-09-13T20:06:31Z

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
Vulnerability: GHSA-5r5r-6hpj-8gg9
Summary: Serialization gadget exploit in jackson-databind
Aliases: CVE-2020-35728
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:15:24Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Vulnerability: GHSA-j3f7-7rmc-6wqj
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40831
Severity: MODERATE
CWE: CWE-295
Published: 2021-11-24T20:35:03Z

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.
Vulnerability: GHSA-c32g-2mgr-cfq7
Summary: Out-of-bounds Write in iText
Aliases: CVE-2022-24197
Severity: MODERATE
CWE: CWE-787
Published: 2022-02-02T00:01:45Z

iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Vulnerability: GHSA-xv7x-x6wr-xx7g
Summary: Moderate severity vulnerability that affects org.apache.ranger:ranger
Aliases: CVE-2016-8746
Severity: MODERATE
CWE: CWE-426
Published: 2018-10-17T17:22:05Z

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
Vulnerability: GHSA-jxm5-5xcw-h57q
Summary: Moderate severity vulnerability that affects org.exist-db:exist-core
Aliases: CVE-2018-1000823
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-20T22:02:17Z

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Vulnerability: GHSA-rcvx-rmvf-mxch
Summary: Cross-site Scripting in Eclipse Hawkbit
Aliases: CVE-2020-27219
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T22:19:44Z

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
Vulnerability: GHSA-w5rh-j4g3-jr29
Summary: Missing Authorization in Jenkins S3 publisher Plugin
Aliases: CVE-2021-21651
Severity: MODERATE
CWE: CWE-862
Published: 2021-06-16T17:29:17Z

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.
Vulnerability: GHSA-4v6p-cxf9-98rf
Summary: Allocation of Resources Without Limits or Throttling in metadata-extractor
Aliases: CVE-2022-24614
Severity: MODERATE
CWE: CWE-770
Published: 2022-02-25T00:01:05Z

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Vulnerability: GHSA-395w-qhqr-9fr6
Summary: Path Traversal in Apache Flink
Aliases: CVE-2020-17519
Severity: MODERATE
CWE: CWE-22, CWE-552
Published: 2021-01-06T20:01:34Z

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
Vulnerability: GHSA-q485-j897-qc27
Summary: Moderate severity vulnerability that affects com.mchange:c3p0
Aliases: CVE-2018-20433
Severity: CRITICAL
CWE: CWE-611
Published: 2019-01-07T19:14:34Z

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Vulnerability: GHSA-v4qh-6367-4cx2
Summary: Server-Side Request Forgery (SSRF) in Apache Olingo
Aliases: CVE-2020-1925
Severity: HIGH
CWE: CWE-918
Published: 2020-02-04T22:38:38Z

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
Vulnerability: GHSA-6v39-p2xq-g5c3
Summary: Missing authentication in ShenYu
Aliases: CVE-2022-23944
Severity: CRITICAL
CWE: CWE-306, CWE-862
Published: 2022-01-28T22:13:44Z

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-w3hj-wr2q-x83g
Summary: Discovery uses the same AES/GCM Nonce throughout the session
Severity: LOW
CWE: CWE-323
Published: 2021-04-06T17:22:17Z

Discovery uses the same AES/GCM Nonce throughout the session though it should be generated on per message basis which can lead to the leaking of the session key.  As the actual ENR record is signed with a different key it is not possible for an attacker to alter the ENR record. Note that the node private key is not compromised, only the session key generated to communicate with an individual peer.

From [discovery spec](https://github.com/ethereum/devp2p/blob/f97b8a5b8e9589d3355ebbd9d4a58d5d1644bdf7/discv5/discv5-theory.md#session-cache):
> The number of messages which can be encrypted with a certain session key is limited because encryption of each message requires a unique nonce for AES-GCM. In addition to the keys, the session cache must also keep track of the count of outgoing messages to ensure the uniqueness of nonce values. Since the wire protocol uses 96 bit AES-GCM nonces, it is strongly recommended to generate them by encoding the current outgoing message count into the first 32 bits of the nonce and filling the remaining 64 bits with random data generated by a cryptographically secure random number generator.
Vulnerability: GHSA-pffw-p2q5-w6vh
Summary: Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-builder and org.apache.jspwiki:jspwiki-war
Aliases: CVE-2019-0225
Severity: HIGH
CWE: CWE-22
Published: 2019-04-08T16:23:36Z

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
Vulnerability: GHSA-gc58-v8h3-x2gr
Summary: Incorrect Default Permissions in Apache Tomcat
Aliases: CVE-2020-8022
Severity: HIGH
CWE: CWE-276
Published: 2022-02-09T23:01:49Z

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
Vulnerability: GHSA-jrg3-qq99-35g7
Summary: Deserialization of Untrusted Data in Jodd
Aliases: CVE-2018-21234
Severity: CRITICAL
CWE: CWE-502
Published: 2022-02-10T23:03:26Z

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Vulnerability: GHSA-gx96-vgf7-hwfg
Summary: In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation
Aliases: CVE-2018-11797
Severity: MODERATE
CWE: CWE-400
Published: 2018-10-17T18:22:29Z

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerability: GHSA-7grw-6pjh-jpc9
Summary: Infinite Loop in Apache PDFBox
Aliases: CVE-2021-31812
Severity: MODERATE
CWE: CWE-835, CWE-834
Published: 2021-06-15T15:54:29Z

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Vulnerability: GHSA-fvm3-cfvj-gxqq
Summary: High severity vulnerability that affects commons-fileupload:commons-fileupload
Aliases: CVE-2016-3092
Severity: HIGH
CWE: CWE-20
Published: 2018-12-21T17:47:47Z

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Vulnerability: GHSA-wfj5-2mqr-7jvv
Summary: Expression Language Injection in Netflix Conductor
Aliases: CVE-2020-9296
Severity: CRITICAL
CWE: CWE-917
Published: 2022-02-10T23:06:57Z

Netflix Conductor uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.
Vulnerability: GHSA-grc3-8q8m-4j7c
Summary: Improper privilege handling in Apache Accumulo
Aliases: CVE-2020-17533
Severity: HIGH
CWE: CWE-732, CWE-280
Published: 2022-02-09T22:37:59Z

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
Vulnerability: GHSA-45hx-wfhj-473x
Summary: Arbitrary code execution in H2 Console
Aliases: CVE-2022-23221
Severity: CRITICAL
CWE: CWE-94
Published: 2022-01-21T23:07:39Z

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Vulnerability: GHSA-83x4-9cwr-5487
Summary: Improper Authorization in Keycloak
Aliases: CVE-2021-4133
Severity: HIGH
CWE: CWE-863
Published: 2022-01-06T18:32:58Z

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
Vulnerability: GHSA-qvm7-23cj-437v
Summary: Remote Code Execution in Apache Dubbo
Aliases: CVE-2021-36161
Severity: CRITICAL
CWE: CWE-134
Published: 2021-09-10T17:54:37Z

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Vulnerability: GHSA-qcj7-g2j5-g7r3
Summary: In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
Aliases: CVE-2016-1000342
Severity: HIGH
CWE: CWE-347
Published: 2018-10-17T16:24:12Z

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Vulnerability: GHSA-6vqp-h455-42mr
Summary: Uncontrolled Memory Allocation in Apache PDFBox
Aliases: CVE-2021-27906
Severity: MODERATE
CWE: CWE-789
Published: 2021-05-13T22:30:13Z

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Vulnerability: GHSA-72m5-fvvv-55m6
Summary: Observable Differences in Behavior to Error Inputs in Bouncy Castle
Aliases: CVE-2020-26939
Severity: MODERATE
CWE: CWE-203
Published: 2021-04-22T16:16:49Z

In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
Vulnerability: GHSA-3rj3-qp2j-4fj2
Summary: Cross-Site Request Forgery in Jenkins P4 Plugin
Aliases: CVE-2021-21655
Severity: HIGH
CWE: CWE-352
Published: 2022-03-18T17:53:10Z

A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
Vulnerability: GHSA-4m9r-5gqp-7j82
Summary: High severity vulnerability that affects org.dspace:dspace-xmlui
Aliases: CVE-2016-10726
Severity: HIGH
CWE: CWE-22
Published: 2018-10-19T16:52:06Z

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
Vulnerability: GHSA-wx5j-54mm-rqqq
Summary: HTTP request smuggling in io.netty:netty-codec-http
Aliases: CVE-2021-43797
Severity: MODERATE
CWE: CWE-444
Published: 2021-12-09T19:09:17Z

### Impact

Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.

Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
Vulnerability: GHSA-r8h9-hq9c-2p5c
Summary: High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Aliases: CVE-2019-1010260
Severity: HIGH
CWE: CWE-319
Published: 2019-04-08T15:18:54Z

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
Vulnerability: GHSA-5pv7-hx9m-8jh3
Summary: Missing permission checks in Jenkins Publish Over FTP Plugin
Aliases: CVE-2022-29051
Severity: MODERATE
CWE: CWE-862
Published: 2022-04-13T00:00:16Z

Missing permission checks in Jenkins Publish Over FTP Plugin prior to 1.17 allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.
Vulnerability: GHSA-4hrm-m67v-5cxr
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21346
Severity: MODERATE
CWE: CWE-502, CWE-434
Published: 2021-03-22T23:28:49Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21346](https://x-stream.github.io/CVE-2021-21346.html).

### Credits
wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-vgvf-9jh3-fg75
Summary: Moderate severity vulnerability that affects io.swagger:swagger-codegen and io.swagger:swagger-parser
Aliases: CVE-2017-1000207
Severity: HIGH
CWE: CWE-502
Published: 2018-10-19T16:46:30Z

A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Vulnerability: GHSA-8cw6-5qvp-q3wj
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-8024
Severity: MODERATE
CWE: CWE-200
Published: 2019-03-14T15:40:57Z

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible  for a malicious user to construct a URL pointing to a Spark cluster's UI's  job and stage info pages, and if a user can be tricked into accessing  the URL, can be used to cause script to execute and expose information  from the user's view of the Spark UI. While some browsers like recent  versions of Chrome and Safari are able to block this type of attack,  current versions of Firefox (and possibly others) do not.
Vulnerability: GHSA-vjw7-6gfq-6wf5
Summary: Path Traversal in Eclipse Vert
Aliases: CVE-2019-17640
Severity: CRITICAL
CWE: CWE-22, CWE-23
Published: 2022-02-10T20:28:57Z

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Vulnerability: GHSA-9378-f4v7-jgm4
Summary: Deserialization of Untrusted Data in org.apache.ddlutils:ddlutils
Aliases: CVE-2021-41616
Severity: CRITICAL
CWE: CWE-502
Published: 2021-10-04T20:12:30Z

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
Vulnerability: GHSA-5429-pjww-7675
Summary: SQL Injection in Apache Kylin
Aliases: CVE-2021-36774
Severity: MODERATE
CWE: CWE-668, CWE-89
Published: 2022-01-08T00:43:04Z

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
Vulnerability: GHSA-m9w8-v359-9ffr
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-client
Aliases: CVE-2018-11775
Severity: HIGH
CWE: CWE-295
Published: 2018-10-19T16:42:27Z

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Vulnerability: GHSA-f92j-qf46-p6vm
Summary: Reflected Cross-site Scripting in ACS Commons
Aliases: CVE-2021-21028
Severity: HIGH
CWE: CWE-79, CWE-416
Published: 2021-02-02T15:46:52Z

### Impact

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly.

An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in v4.10.0

### Workarounds

No workaround exist.

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Christopher Whipp (Christopher.Whipp@servicesaustralia.gov.au).
Vulnerability: GHSA-mp28-rq7g-qx62
Summary: Remote code execution in Apache TomEE
Aliases: CVE-2020-13931
Severity: CRITICAL
CWE: CWE-306
Published: 2022-02-09T22:44:38Z

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Vulnerability: GHSA-qcjv-wfcg-mmpr
Summary: Critical severity vulnerability that affects org.apache.ignite:ignite-core
Aliases: CVE-2018-8018
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-16T20:53:54Z

Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.
Vulnerability: GHSA-8mr5-h28g-36qx
Summary: Spring AOP functionality (Struts) vulnerable to DoS attack
Aliases: CVE-2017-9787
Severity: HIGH
Published: 2018-10-16T19:37:07Z

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
Vulnerability: GHSA-p8ww-vv84-c2rm
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2912
Severity: HIGH
CWE: CWE-352
Published: 2018-10-18T17:41:13Z

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
Vulnerability: GHSA-4mq5-mj59-qq9c
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10093
Severity: MODERATE
CWE: CWE-770
Published: 2019-08-06T01:43:38Z

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Vulnerability: GHSA-7qw5-pqhc-xm4g
Summary: Users with SCRIPT right can execute arbitrary code in XWiki
Aliases: CVE-2020-15171
Severity: LOW
CWE: CWE-74, CWE-94
Published: 2020-09-10T19:19:27Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.2.1 and XWiki 11.10.5.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17141
https://jira.xwiki.org/browse/XWIKI-17266

It's been reported by the GitHub Security Lab under #GHSL-2020-046.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-qwh6-xwj4-9cjg
Summary: Remote code execution in net.mingsoft:ms-mcms
Aliases: CVE-2021-46384
Severity: CRITICAL
CWE: CWE-287
Published: 2022-03-05T00:00:41Z

net.mingsoft:ms-mcms <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
Vulnerability: GHSA-rcjj-h6gh-jf3r
Summary: Information Disclosure in Apache Groovy
Aliases: CVE-2020-17521
Severity: MODERATE
CWE: CWE-379
Published: 2020-12-09T19:03:03Z

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Vulnerability: GHSA-p8jx-x2vw-wm33
Summary: High severity vulnerability that affects org.apache.storm:storm-core
Aliases: CVE-2018-1331
Severity: HIGH
Published: 2018-10-17T19:48:06Z

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.
Vulnerability: GHSA-9f52-hpvw-v96w
Summary: Improper Validation of Specified Quantity in Input in Eclipse Hono
Aliases: CVE-2020-27217
Severity: HIGH
CWE: CWE-1284
Published: 2022-02-10T20:22:06Z

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
Vulnerability: GHSA-q8xj-8xg3-w432
Summary: Moderate severity vulnerability that affects io.spray:spray-json_2.10, io.spray:spray-json_2.11, and io.spray:spray-json_2.12
Aliases: CVE-2018-18854
Severity: HIGH
CWE: CWE-400
Published: 2018-11-09T17:41:35Z

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
Vulnerability: GHSA-rjww-2x8v-m9v9
Summary: Potential sensitive data exposure in applications using Vaadin 15
Aliases: CVE-2020-36319
Severity: LOW
CWE: CWE-200
Published: 2021-04-19T14:52:14Z

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319
Vulnerability: GHSA-3h29-52vh-pqgr
Summary: Uncontrolled Resource Consumption in Apache Tika
Aliases: CVE-2020-1950
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-07T15:53:48Z

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
Vulnerability: GHSA-rmr5-cpv2-vgjf
Summary: Denial of Service by injecting highly recursive collections or maps in XStream
Aliases: CVE-2021-43859
Severity: HIGH
CWE: CWE-502, CWE-400
Published: 2022-02-01T00:48:15Z

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream.

### Patches
XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded.

### Workarounds
The attack uses the hash code implementation for collections and maps to force an exponential calculation time due to highly recursive structures with in the collection or map. Following types of the Java runtime are affected in Java versions available in December 2021:

- java.util.HashMap
- java.util.HashSet
- java.util.Hashtable
- java.util.LinkedHashMap
- java.util.LinkedHashSet
- java.util.Stack (older Java revisions only)
- java.util.Vector (older Java revisions only)
- Other third party collection implementations that use their element's hash code may also be affected

If your object graph does not use referenced elements at all, you may simply set the NO_REFERENCE mode:
```Java
XStream xstream = new XStream();
xstream.setMode(XStream.NO_REFERENCES);
```

If your object graph contains neither a Hashtable, HashMap nor a HashSet (or one of the linked variants of it) then you can use the security framework to deny the usage of these types:
```Java
XStream xstream = new XStream();
xstream.denyTypes(new Class[]{
 java.util.HashMap.class, java.util.HashSet.class, java.util.Hashtable.class, java.util.LinkedHashMap.class, java.util.LinkedHashSet.class
});
```

Unfortunately these types are very common. If you only use HashMap or HashSet and your XML refers these only as default map or set, you may additionally change the default implementation of java.util.Map and java.util.Set at unmarshalling time::
```Java
xstream.addDefaultImplementation(java.util.TreeMap.class, java.util.Map.class);
xstream.addDefaultImplementation(java.util.TreeSet.class, java.util.Set.class);
```
However, this implies that your application does not care about the implementation of the map and all elements are comparable.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-43859](https://x-stream.github.io/CVE-2021-43859.html).

### Credits
The vulnerability was discovered and reported by r00t4dm at Cloud-Penetrating Arrow Lab.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-645p-88qh-w398
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14718
Severity: CRITICAL
CWE: CWE-502
Published: 2019-01-04T19:06:55Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.