Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 7.4.0Report Generated On : Sat, 10 Dec 2022 22:20:43 GMTDependencies Scanned : 548 (363 unique)Vulnerable Dependencies : 89 Vulnerabilities Found : 338Vulnerabilities Suppressed : 0... NVD CVE Checked : 2022-12-10T21:48:37NVD CVE Modified : 2022-12-10T21:00:02VersionCheckOn : 2022-12-09T00:30:37Summary Display:
Showing Vulnerable Dependencies (click to show all) Dependencies Description:
The bit array data structure is implemented in Java as the BitSet class. Unfortunately, this fails to scale without compression.
JavaEWAH is a word-aligned compressed variant of the Java bitset class. It uses a 64-bit run-length encoding (RLE) compression scheme.
The goal of word-aligned compression is not to achieve the best compression, but rather to improve query processing time. Hence, we try to save CPU cycles, maybe at the expense of storage. However, the EWAH scheme we implemented is always more efficient storage-wise than an uncompressed bitmap (implemented in Java as the BitSet class). Unlike some alternatives, javaewah does not rely on a patented scheme. License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/googlecode/javaewah/JavaEWAH/0.3.2/JavaEWAH-0.3.2.jar
MD5: 2abde98a935176283db25a9bc70fb520
SHA1: 7130b68f1d4d9666f0ced0ba1a1bee37e2e51926
SHA256: 93123dc8204cbc6248565ca6b81543ab0e15c2421173b9be84bf50540d811dea
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name JavaEWAH High Vendor jar package name javaewah Highest Vendor jar package name javaewah Low Vendor pom artifactid JavaEWAH Highest Vendor pom artifactid JavaEWAH Low Vendor pom developer email lemire@gmail.com Low Vendor pom developer id lemire Medium Vendor pom developer name Daniel Lemire Medium Vendor pom developer org LICEF Research Center Medium Vendor pom developer org URL http://licef.ca Medium Vendor pom groupid com.googlecode.javaewah Highest Vendor pom name JavaEWAH High Vendor pom url http://code.google.com/p/javaewah/ Highest Product file name JavaEWAH High Product jar package name javaewah Highest Product pom artifactid JavaEWAH Highest Product pom developer email lemire@gmail.com Low Product pom developer id lemire Low Product pom developer name Daniel Lemire Low Product pom developer org LICEF Research Center Low Product pom developer org URL http://licef.ca Low Product pom groupid com.googlecode.javaewah Highest Product pom name JavaEWAH High Product pom url http://code.google.com/p/javaewah/ Medium Version file version 0.3.2 High Version pom version 0.3.2 Highest
Description:
Roaring bitmaps are compressed bitmaps (also called bitsets) which tend to outperform
conventional compressed bitmaps such as WAH or Concise. License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/roaringbitmap/RoaringBitmap/0.7.45/RoaringBitmap-0.7.45.jar
MD5: 27d1d944c1f540e8771b9eb9aead1efb
SHA1: cf97912280a8bc6f740d0e2c15b8acdfeb683ac3
SHA256: 5db5c2bb8e5cd5368bd0784f427a55666507d7158c316afef4e1346b7246177e
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name RoaringBitmap High Vendor jar package name roaringbitmap Highest Vendor Manifest multi-release true Low Vendor pom artifactid RoaringBitmap Highest Vendor pom artifactid RoaringBitmap Low Vendor pom developer email lemire@gmail.com Low Vendor pom developer id lemire Medium Vendor pom developer name Daniel Lemire Medium Vendor pom groupid org.roaringbitmap Highest Vendor pom name RoaringBitmap High Vendor pom parent-artifactid RoaringBitmapParent Low Vendor pom url RoaringBitmap/RoaringBitmap Highest Product file name RoaringBitmap High Product jar package name roaringbitmap Highest Product Manifest multi-release true Low Product pom artifactid RoaringBitmap Highest Product pom developer email lemire@gmail.com Low Product pom developer id lemire Low Product pom developer name Daniel Lemire Low Product pom groupid org.roaringbitmap Highest Product pom name RoaringBitmap High Product pom parent-artifactid RoaringBitmapParent Medium Product pom url RoaringBitmap/RoaringBitmap High Version file version 0.7.45 High Version pom version 0.7.45 Highest
Description:
StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output.
StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization.
It evolved over years of effort developing jGuru.com.
StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic
is that unlike other engines, it strictly enforces model-view separation.
Strict separation makes websites and code generators more flexible
and maintainable; it also provides an excellent defense against malicious
template authors.
There are currently about 600 StringTemplate source downloads a month.
License:
BSD licence: http://antlr.org/license.html File Path: /root/.m2/repository/org/antlr/ST4/4.0.4/ST4-4.0.4.jar
MD5: 06856c607f242639cd52ef2b4c63ebc9
SHA1: 467a2aa12be6d0f0f68c70eecf6714ab733027ac
SHA256: 17cc49dc535a0fbe58c3a8634e774572bed31eb73415e9ce9d2703b977bf356f
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name ST4 High Vendor jar package name compiler Low Vendor jar package name stringtemplate Highest Vendor jar package name stringtemplate Low Vendor jar package name v4 Low Vendor pom artifactid ST4 Highest Vendor pom artifactid ST4 Low Vendor pom developer email jimi@temporal-wave.com Low Vendor pom developer email parrt@antlr.org Low Vendor pom developer name Jim Idle Medium Vendor pom developer name Terence Parr Medium Vendor pom developer org Temporal Wave LLC Medium Vendor pom developer org USFCA Medium Vendor pom developer org URL http://www.cs.usfca.edu Medium Vendor pom developer org URL http://www.temporal-wave.com Medium Vendor pom groupid org.antlr Highest Vendor pom name ANTLR ST4 4.0.4 High Vendor pom url http://www.stringtemplate.org Highest Product file name ST4 High Product jar package name compiler Low Product jar package name stringtemplate Highest Product jar package name v4 Low Product pom artifactid ST4 Highest Product pom developer email jimi@temporal-wave.com Low Product pom developer email parrt@antlr.org Low Product pom developer name Jim Idle Low Product pom developer name Terence Parr Low Product pom developer org Temporal Wave LLC Low Product pom developer org USFCA Low Product pom developer org URL http://www.cs.usfca.edu Low Product pom developer org URL http://www.temporal-wave.com Low Product pom groupid org.antlr Highest Product pom name ANTLR ST4 4.0.4 High Product pom url http://www.stringtemplate.org Medium Version file version 4.0.4 High Version pom version 4.0.4 Highest
Description:
The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data License:
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html File Path: /root/.m2/repository/javax/activation/activation/1.1.1/activation-1.1.1.jar
MD5: 46a37512971d8eca81c3fcf245bf07d2
SHA1: 485de3a253e23f645037828c07f1d7f1af40763a
SHA256: ae475120e9fcd99b4b00b38329bd61cdc5eb754eee03fe66c01f50e137724f99
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name activation High Vendor jar package name activation Highest Vendor jar package name javax Highest Vendor jar package name sun Highest Vendor jar (hint) package name oracle Highest Vendor Manifest extension-name javax.activation Medium Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom artifactid activation Highest Vendor pom artifactid activation Low Vendor pom groupid javax.activation Highest Vendor pom name JavaBeans(TM) Activation Framework High Vendor pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Highest Product file name activation High Product jar package name activation Highest Product jar package name javax Highest Product Manifest extension-name javax.activation Medium Product Manifest specification-title JavaBeans(TM) Activation Framework Specification Medium Product pom artifactid activation Highest Product pom groupid javax.activation Highest Product pom name JavaBeans(TM) Activation Framework High Product pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Medium Version file version 1.1.1 High Version Manifest Implementation-Version 1.1.1 High Version pom version 1.1.1 Highest
Description:
JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
License:
Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html File Path: /root/.m2/repository/javax/activation/activation/1.1/activation-1.1.jar
MD5: 8ae38e87cd4f86059c0294a8fe3e0b18
SHA1: e6cb541461c2834bdea3eb920f1884d1eb508b50
SHA256: 2881c79c9d6ef01c58e62beea13e9d1ac8b8baa16f2fc198ad6e6776defdcdd3
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name activation High Vendor jar package name activation Highest Vendor jar package name javax Highest Vendor jar package name sun Highest Vendor jar (hint) package name oracle Highest Vendor Manifest extension-name javax.activation Medium Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom artifactid activation Highest Vendor pom artifactid activation Low Vendor pom groupid javax.activation Highest Vendor pom name JavaBeans Activation Framework (JAF) High Vendor pom url http://java.sun.com/products/javabeans/jaf/index.jsp Highest Product file name activation High Product jar package name activation Highest Product jar package name javax Highest Product Manifest extension-name javax.activation Medium Product Manifest specification-title JavaBeans(TM) Activation Framework Specification Medium Product pom artifactid activation Highest Product pom groupid javax.activation Highest Product pom name JavaBeans Activation Framework (JAF) High Product pom url http://java.sun.com/products/javabeans/jaf/index.jsp Medium Version file version 1.1 High Version Manifest Implementation-Version 1.1 High Version pom version 1.1 Highest
Description:
Compression algorithms License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/airlift/aircompressor/0.10/aircompressor-0.10.jar
MD5: f7530afc9741d3594cb9f86a2ab875c2
SHA1: bf8305930ec675964bd68599c702ffb32df4d1e6
SHA256: a5471abddc99a95939abfc0405cddb2213c4fba561de94f888d6e625566e826c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name aircompressor High Vendor jar package name airlift Highest Vendor jar package name io Highest Vendor Manifest build-time 2018-04-27T10:23:16-0700 Low Vendor Manifest git-commit-id 7e230d91aff4d8bd5dbb2177e4595226b4edc2e8 Low Vendor Manifest Implementation-Vendor-Id io.airlift Medium Vendor pom artifactid aircompressor Highest Vendor pom artifactid aircompressor Low Vendor pom groupid io.airlift Highest Vendor pom name aircompressor High Vendor pom parent-artifactid airbase Low Vendor pom url http://github.com/airlift/aircompressor Highest Product file name aircompressor High Product jar package name airlift Highest Product jar package name io Highest Product Manifest build-time 2018-04-27T10:23:16-0700 Low Product Manifest git-commit-id 7e230d91aff4d8bd5dbb2177e4595226b4edc2e8 Low Product Manifest Implementation-Title aircompressor High Product Manifest specification-title aircompressor Medium Product pom artifactid aircompressor Highest Product pom groupid io.airlift Highest Product pom name aircompressor High Product pom parent-artifactid airbase Medium Product pom url http://github.com/airlift/aircompressor Medium Version file version 0.10 High Version Manifest Implementation-Version 0.10 High Version pom parent-version 0.10 Low Version pom version 0.10 Highest
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.jsMD5: 43e4ef9bd61d65f393a45ae15b1cc807SHA1: 89404bd69f724ead1e607b321ff4e3887b56ce17SHA256: 8048719c9cad45a94de28e437b6beb1ccc9fc94e2c3c9a5a076bef3fccea8642Referenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
A framework for constructing recognizers, compilers,
and translators from grammatical descriptions containing
Java, C#, C++, or Python actions.
License:
BSD License: http://www.antlr.org/license.html File Path: /root/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
SHA256: 88fbda4b912596b9f56e8e12e580cc954bacfb51776ecfddd3e18fc1cf56dc4c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name antlr High Vendor jar package name actions Highest Vendor jar package name antlr Highest Vendor jar package name antlr Low Vendor jar package name java Highest Vendor jar package name parser Highest Vendor jar package name python Highest Vendor pom artifactid antlr Highest Vendor pom artifactid antlr Low Vendor pom groupid antlr Highest Vendor pom name AntLR Parser Generator High Vendor pom url http://www.antlr.org/ Highest Product file name antlr High Product jar package name actions Highest Product jar package name antlr Highest Product jar package name java Highest Product jar package name parser Highest Product jar package name python Highest Product pom artifactid antlr Highest Product pom groupid antlr Highest Product pom name AntLR Parser Generator High Product pom url http://www.antlr.org/ Medium Version file version 2.7.7 High Version pom version 2.7.7 Highest
Description:
A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. File Path: /root/.m2/repository/org/antlr/antlr-runtime/3.4/antlr-runtime-3.4.jarMD5: 0e0318be407e51fdf7ba6777eabfdf73SHA1: 8f011408269a8e42b8548687e137d8eeb56df4b4SHA256: 5b7cf53b7b30b034023f58030c8147c433f2bee0fe7dec8fae6bebf3708c5a63Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name antlr-runtime High Vendor jar package name antlr Highest Vendor jar package name antlr Low Vendor jar package name runtime Highest Vendor jar package name runtime Low Vendor pom artifactid antlr-runtime Highest Vendor pom artifactid antlr-runtime Low Vendor pom developer email jimi@temporal-wave.com Low Vendor pom developer email parrt@antlr.org Low Vendor pom developer name Jim Idle Medium Vendor pom developer name Terence Parr Medium Vendor pom developer org Temporal Wave LLC Medium Vendor pom developer org USFCA Medium Vendor pom developer org URL http://www.cs.usfca.edu Medium Vendor pom developer org URL http://www.temporal-wave.com Medium Vendor pom groupid org.antlr Highest Vendor pom name Antlr 3.4 Runtime High Vendor pom parent-artifactid antlr-master Low Vendor pom url http://www.antlr.org Highest Product file name antlr-runtime High Product jar package name antlr Highest Product jar package name runtime Highest Product jar package name runtime Low Product pom artifactid antlr-runtime Highest Product pom developer email jimi@temporal-wave.com Low Product pom developer email parrt@antlr.org Low Product pom developer name Jim Idle Low Product pom developer name Terence Parr Low Product pom developer org Temporal Wave LLC Low Product pom developer org USFCA Low Product pom developer org URL http://www.cs.usfca.edu Low Product pom developer org URL http://www.temporal-wave.com Low Product pom groupid org.antlr Highest Product pom name Antlr 3.4 Runtime High Product pom parent-artifactid antlr-master Medium Product pom url http://www.antlr.org Medium Version file version 3.4 High Version pom version 3.4 Highest
Description:
The ANTLR 4 Runtime License:
http://www.antlr.org/license.html File Path: /root/.m2/repository/org/antlr/antlr4-runtime/4.7/antlr4-runtime-4.7.jar
MD5: b79f55024206b39be2539e1ecfde0c0a
SHA1: 30b13b7efc55b7feea667691509cf59902375001
SHA256: 2a61943f803bbd1d0e02dffd19b92a418f83340c994346809e3b51e2231aa6c0
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name antlr4-runtime High Vendor jar package name antlr Highest Vendor jar package name runtime Highest Vendor Manifest bundle-docurl http://www.antlr.org Low Vendor Manifest bundle-symbolicname org.antlr.antlr4-runtime Medium Vendor Manifest implementation-url http://www.antlr.org/runtime/antlr4-runtime Low Vendor Manifest Implementation-Vendor ANTLR High Vendor Manifest Implementation-Vendor-Id org.antlr Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom artifactid antlr4-runtime Highest Vendor pom artifactid antlr4-runtime Low Vendor pom groupid org.antlr Highest Vendor pom name ANTLR 4 Runtime High Vendor pom parent-artifactid antlr4-master Low Product file name antlr4-runtime High Product jar package name antlr Highest Product jar package name runtime Highest Product Manifest bundle-docurl http://www.antlr.org Low Product Manifest Bundle-Name ANTLR 4 Runtime Medium Product Manifest bundle-symbolicname org.antlr.antlr4-runtime Medium Product Manifest Implementation-Title ANTLR 4 Runtime High Product Manifest implementation-url http://www.antlr.org/runtime/antlr4-runtime Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product pom artifactid antlr4-runtime Highest Product pom groupid org.antlr Highest Product pom name ANTLR 4 Runtime High Product pom parent-artifactid antlr4-master Medium Version file version 4.7 High Version Manifest Implementation-Version 4.7 High Version pom version 4.7 Highest
Description:
AOP Alliance License:
Public Domain File Path: /root/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
SHA256: 0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name aopalliance High Vendor jar package name aop Highest Vendor jar package name aopalliance Highest Vendor jar package name aopalliance Low Vendor jar package name intercept Low Vendor pom artifactid aopalliance Highest Vendor pom artifactid aopalliance Low Vendor pom groupid aopalliance Highest Vendor pom name AOP alliance High Vendor pom url http://aopalliance.sourceforge.net Highest Product file name aopalliance High Product jar package name aop Highest Product jar package name aopalliance Highest Product jar package name intercept Low Product pom artifactid aopalliance Highest Product pom groupid aopalliance Highest Product pom name AOP alliance High Product pom url http://aopalliance.sourceforge.net Medium Version file version 1.0 High Version pom version 1.0 Highest
Description:
Dependency Injection Kernel License:
https://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/hk2/external/aopalliance-repackaged/2.4.0-b34/aopalliance-repackaged-2.4.0-b34.jar
MD5: 57983543b3574e117d6f03ceff5f238c
SHA1: 3d5e856dbc91a3a2b0bcb3a3424f8b62421ae4cf
SHA256: 5d3cb0cece722c7ba8ab987b931053cdbcb0cb12ad5c8c8a7691eb6f7e60a64b
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name aopalliance-repackaged High Vendor jar package name aopalliance Highest Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.external.aopalliance-repackaged Medium Vendor pom artifactid aopalliance-repackaged Highest Vendor pom artifactid aopalliance-repackaged Low Vendor pom groupid org.glassfish.hk2.external Highest Vendor pom name aopalliance version ${aopalliance.version} repackaged as a module High Vendor pom parent-artifactid external Low Vendor pom parent-groupid org.glassfish.hk2 Medium Product file name aopalliance-repackaged High Product jar package name aopalliance Highest Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name aopalliance version 1.0 repackaged as a module Medium Product Manifest bundle-symbolicname org.glassfish.hk2.external.aopalliance-repackaged Medium Product pom artifactid aopalliance-repackaged Highest Product pom groupid org.glassfish.hk2.external Highest Product pom name aopalliance version ${aopalliance.version} repackaged as a module High Product pom parent-artifactid external Medium Product pom parent-groupid org.glassfish.hk2 Medium Version pom version 2.4.0-b34 Highest
Description:
This package provides additional appenders, filters and
other capabilities for version 1.2 of Apache log4j™. Several of these were backported from
the abandoned Apache log4j 1.3 development effort.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/log4j/apache-log4j-extras/1.2.17/apache-log4j-extras-1.2.17.jar
MD5: f32ed7ae770c83a4ac6fe6714f98f1bd
SHA1: 85863614d82185d7e51fe21c00aa9117a523a8b6
SHA256: 361d4d40350309978b5ac2e45b2e93d72ad5864ad4da74afc1898ddd8d0550d0
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name apache-log4j-extras High Vendor jar package name apache Highest Vendor jar package name extras Highest Vendor jar package name log4j Highest Vendor Manifest bundle-docurl http://logging.apache.org/log4j/extras/index.html Low Vendor Manifest bundle-symbolicname log4j.apache-log4j-extras Medium Vendor pom artifactid apache-log4j-extras Highest Vendor pom artifactid apache-log4j-extras Low Vendor pom groupid log4j Highest Vendor pom name Apache Extras™ for Apache log4j™. High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://logging.apache.org/log4j/extras Highest Product file name apache-log4j-extras High Product jar package name apache Highest Product jar package name extras Highest Product jar package name log4j Highest Product Manifest bundle-docurl http://logging.apache.org/log4j/extras/index.html Low Product Manifest Bundle-Name Apache Extras™ for Apache log4j™. Medium Product Manifest bundle-symbolicname log4j.apache-log4j-extras Medium Product pom artifactid apache-log4j-extras Highest Product pom groupid log4j Highest Product pom name Apache Extras™ for Apache log4j™. High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://logging.apache.org/log4j/extras Medium Version file version 1.2.17 High Version Manifest Bundle-Version 1.2.17 High Version pom parent-version 1.2.17 Low Version pom version 1.2.17 Highest
CVE-2019-17571 suppress
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-9493 suppress
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23305 suppress
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23302 suppress
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.0) Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23307 suppress
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Internationalization of errors and other messages License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/server/apacheds-i18n/2.0.0-M15/apacheds-i18n-2.0.0-M15.jar
MD5: f5877c02fd56ade67713560e589c81b9
SHA1: 71c61c84683152ec2a6a65f3f96fe534e304fa22
SHA256: bd3b7cece7fc6364cbce32b9edd0e9628a3e889c6a93cdeff1b5e2131e2a007c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name apacheds-i18n High Vendor jar package name apache Highest Vendor jar package name directory Highest Vendor jar package name i18n Highest Vendor jar package name server Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.server.i18n Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.server Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid apacheds-i18n Highest Vendor pom artifactid apacheds-i18n Low Vendor pom groupid org.apache.directory.server Highest Vendor pom name ApacheDS I18n High Vendor pom parent-artifactid apacheds-parent Low Product file name apacheds-i18n High Product jar package name apache Highest Product jar package name directory Highest Product jar package name i18n Highest Product jar package name server Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name ApacheDS I18n Medium Product Manifest bundle-symbolicname org.apache.directory.server.i18n Medium Product Manifest Implementation-Title ApacheDS I18n High Product Manifest specification-title ApacheDS I18n Medium Product pom artifactid apacheds-i18n Highest Product pom groupid org.apache.directory.server Highest Product pom name ApacheDS I18n High Product pom parent-artifactid apacheds-parent Medium Version Manifest Implementation-Version 2.0.0-M15 High Version pom version 2.0.0-M15 Highest
Description:
Internationalization of errors and other messages License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/server/apacheds-i18n/2.0.0-M21/apacheds-i18n-2.0.0-M21.jar
MD5: 0f985cfd476b1e150580dc7e2d2cba0e
SHA1: 1cad886a17dbe04a1093df6db17f4c33ce46c3dd
SHA256: 7054cb9bba5a8ad29b2cc82a1d0e0aee60d87347dffd402570ff47fa0ea1f883
Referenced In Project/Scope: livy-server:compile
Evidence Type Source Name Value Confidence Vendor file name apacheds-i18n High Vendor jar package name apache Highest Vendor jar package name directory Highest Vendor jar package name i18n Highest Vendor jar package name server Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.server.i18n Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.server Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid apacheds-i18n Highest Vendor pom artifactid apacheds-i18n Low Vendor pom groupid org.apache.directory.server Highest Vendor pom name ApacheDS I18n High Vendor pom parent-artifactid apacheds-parent Low Product file name apacheds-i18n High Product jar package name apache Highest Product jar package name directory Highest Product jar package name i18n Highest Product jar package name server Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name ApacheDS I18n Medium Product Manifest bundle-symbolicname org.apache.directory.server.i18n Medium Product Manifest Implementation-Title ApacheDS I18n High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title ApacheDS I18n Medium Product pom artifactid apacheds-i18n Highest Product pom groupid org.apache.directory.server Highest Product pom name ApacheDS I18n High Product pom parent-artifactid apacheds-parent Medium Version Manifest Implementation-Version 2.0.0-M21 High Version pom version 2.0.0-M21 Highest
Description:
The Kerberos protocol encoder/decoder module License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/server/apacheds-kerberos-codec/2.0.0-M15/apacheds-kerberos-codec-2.0.0-M15.jar
MD5: 3118e22eac44e150c383df1d417772f4
SHA1: 1c16e4e477183641c5f0dd5cdecd27ec331bacb5
SHA256: 4996f5b72497e94dd86d64a370158c4fb0049eea9b17ff8b27a4671d6c136ded
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name apacheds-kerberos-codec High Vendor jar package name apache Highest Vendor jar package name directory Highest Vendor jar package name kerberos Highest Vendor jar package name server Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.server.kerberos.codec Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.server Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid apacheds-kerberos-codec Highest Vendor pom artifactid apacheds-kerberos-codec Low Vendor pom groupid org.apache.directory.server Highest Vendor pom name ApacheDS Protocol Kerberos Codec High Vendor pom parent-artifactid apacheds-parent Low Product file name apacheds-kerberos-codec High Product jar package name apache Highest Product jar package name directory Highest Product jar package name kerberos Highest Product jar package name server Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name ApacheDS Protocol Kerberos Codec Medium Product Manifest bundle-symbolicname org.apache.directory.server.kerberos.codec Medium Product Manifest Implementation-Title ApacheDS Protocol Kerberos Codec High Product Manifest specification-title ApacheDS Protocol Kerberos Codec Medium Product pom artifactid apacheds-kerberos-codec Highest Product pom groupid org.apache.directory.server Highest Product pom name ApacheDS Protocol Kerberos Codec High Product pom parent-artifactid apacheds-parent Medium Version Manifest Implementation-Version 2.0.0-M15 High Version pom version 2.0.0-M15 Highest
Description:
ASN.1 API License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/api/api-asn1-api/1.0.0-M20/api-asn1-api-1.0.0-M20.jar
MD5: cf4561832dab76e9f37461342ec18d17
SHA1: 5e6486ffa3125ba44dc410ead166e1d6ba8ac76d
SHA256: 484aaf4b888b0eb699d95bea265c2d5b6ebec951d70e5c5f7691cd52dd4c8298
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name api-asn1-api High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name asn1 Highest Vendor jar package name directory Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.api.asn1.api Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.api Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid api-asn1-api Highest Vendor pom artifactid api-asn1-api Low Vendor pom groupid org.apache.directory.api Highest Vendor pom name Apache Directory API ASN.1 API High Vendor pom parent-artifactid api-asn1-parent Low Product file name api-asn1-api High Product jar package name apache Highest Product jar package name api Highest Product jar package name asn1 Highest Product jar package name directory Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Apache Directory API ASN.1 API Medium Product Manifest bundle-symbolicname org.apache.directory.api.asn1.api Medium Product Manifest Implementation-Title Apache Directory API ASN.1 API High Product Manifest specification-title Apache Directory API ASN.1 API Medium Product pom artifactid api-asn1-api Highest Product pom groupid org.apache.directory.api Highest Product pom name Apache Directory API ASN.1 API High Product pom parent-artifactid api-asn1-parent Medium Version Manifest Implementation-Version 1.0.0-M20 High Version pom version 1.0.0-M20 Highest
Description:
ASN.1 API License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/api/api-asn1-api/1.0.0-M33/api-asn1-api-1.0.0-M33.jar
MD5: c46687f9e497f748586dc7275819989b
SHA1: 1f52883cba4ce7ca668e7d3229fed3d2e1145c1d
SHA256: 52e19e3c767a5be4e9358341233a27d94187dfdd99ff4e90ddf9ea443bcaf22c
Referenced In Project/Scope: livy-server:compile
Evidence Type Source Name Value Confidence Vendor file name api-asn1-api High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name asn1 Highest Vendor jar package name directory Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.api.asn1.api Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.api Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid api-asn1-api Highest Vendor pom artifactid api-asn1-api Low Vendor pom groupid org.apache.directory.api Highest Vendor pom name Apache Directory API ASN.1 API High Vendor pom parent-artifactid api-asn1-parent Low Product file name api-asn1-api High Product jar package name apache Highest Product jar package name api Highest Product jar package name asn1 Highest Product jar package name directory Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Apache Directory API ASN.1 API Medium Product Manifest bundle-symbolicname org.apache.directory.api.asn1.api Medium Product Manifest Implementation-Title Apache Directory API ASN.1 API High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title Apache Directory API ASN.1 API Medium Product pom artifactid api-asn1-api Highest Product pom groupid org.apache.directory.api Highest Product pom name Apache Directory API ASN.1 API High Product pom parent-artifactid api-asn1-parent Medium Version Manifest Implementation-Version 1.0.0-M33 High Version pom version 1.0.0-M33 Highest
Description:
Internationalization of errors and other messages License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/api/api-i18n/1.0.0-M33/api-i18n-1.0.0-M33.jar
MD5: e3366b8887e825cbdb66ca36a1ca665a
SHA1: d1cd144cdde056ee5f09048aa6aa1da23b823871
SHA256: f8884053153ca27cd3e1d51f75889a065794d214815bf4712e7ef923f182392f
Referenced In Project/Scope: livy-server:compile
Evidence Type Source Name Value Confidence Vendor file name api-i18n High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name directory Highest Vendor jar package name i18n Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.api.i18n Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.directory.api Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid api-i18n Highest Vendor pom artifactid api-i18n Low Vendor pom groupid org.apache.directory.api Highest Vendor pom name Apache Directory LDAP API I18n High Vendor pom parent-artifactid api-parent Low Product file name api-i18n High Product jar package name apache Highest Product jar package name api Highest Product jar package name directory Highest Product jar package name i18n Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Apache Directory LDAP API I18n Medium Product Manifest bundle-symbolicname org.apache.directory.api.i18n Medium Product Manifest Implementation-Title Apache Directory LDAP API I18n High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title Apache Directory LDAP API I18n Medium Product pom artifactid api-i18n Highest Product pom groupid org.apache.directory.api Highest Product pom name Apache Directory LDAP API I18n High Product pom parent-artifactid api-parent Medium Version Manifest Implementation-Version 1.0.0-M33 High Version pom version 1.0.0-M33 Highest
Related Dependencies api-util-1.0.0-M33.jarFile Path: /root/.m2/repository/org/apache/directory/api/api-util/1.0.0-M33/api-util-1.0.0-M33.jar MD5: bed1747f54ca65eef5b29a177f1ea424 SHA1: d75b8442dcd1cd11670254c4bcc6c883fada2e88 SHA256: 7ef0f2f02751edf6e60627163a779b058bb3509bb9847c526348180d7aec8d4d pkg:maven/org.apache.directory.api/api-util@1.0.0-M33 CVE-2018-1337 suppress
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request). CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
Description:
Utilities shared across this top level project License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/directory/api/api-util/1.0.0-M20/api-util-1.0.0-M20.jar
MD5: 2c5a6722666882024becdd64301be492
SHA1: a871abf060b3cf83fc6dc4d7e3d151fce50ac3cb
SHA256: fd32fd047ccf143c58d093b58811aa81e539f8cf83c1187809f1a241a1df12d1
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name api-util High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name directory Highest Vendor jar package name util Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname org.apache.directory.api.util Medium Vendor pom artifactid api-util Highest Vendor pom artifactid api-util Low Vendor pom groupid org.apache.directory.api Highest Vendor pom name Apache Directory LDAP API Utilities High Vendor pom parent-artifactid api-parent Low Product file name api-util High Product jar package name apache Highest Product jar package name api Highest Product jar package name directory Highest Product jar package name util Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Apache Directory LDAP API Utilities Medium Product Manifest bundle-symbolicname org.apache.directory.api.util Medium Product pom artifactid api-util Highest Product pom groupid org.apache.directory.api Highest Product pom name Apache Directory LDAP API Utilities High Product pom parent-artifactid api-parent Medium Version pom version 1.0.0-M20 Highest
CVE-2018-1337 suppress
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request). CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
Description:
Java APIs for the BLAS, LAPACK, and ARPACK Fortran libraries as translated through F2J. License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/net/sourceforge/f2j/arpack_combined_all/0.1/arpack_combined_all-0.1.jar
MD5: 83d82dd480da2aeba6429e746453ec0b
SHA1: 225619a060b42605b4d9fd4af11815664abf26eb
SHA256: 9964fb948ef213548a79b23dd480af9d72f1450824fa006bbfea211ac1ffa6dc
Referenced In Projects/Scopes: livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name arpack_combined_all High Vendor jar package name arpack Highest Vendor jar package name blas Highest Vendor jar package name lapack Highest Vendor jar package name lapack Low Vendor jar package name netlib Low Vendor pom artifactid arpack_combined_all Highest Vendor pom artifactid arpack_combined_all Low Vendor pom developer name Dave Doolin Medium Vendor pom developer name Jack Dongarra Medium Vendor pom developer name Keith Seymour Medium Vendor pom groupid net.sourceforge.f2j Highest Vendor pom name Fortran to Java ARPACK High Vendor pom url http://f2j.sourceforge.net Highest Product file name arpack_combined_all High Product jar package name arpack Highest Product jar package name blas Highest Product jar package name lapack Highest Product jar package name lapack Low Product pom artifactid arpack_combined_all Highest Product pom developer name Dave Doolin Low Product pom developer name Jack Dongarra Low Product pom developer name Keith Seymour Low Product pom groupid net.sourceforge.f2j Highest Product pom name Fortran to Java ARPACK High Product pom url http://f2j.sourceforge.net Medium Version file version 0.1 High Version pom version 0.1 Highest
CVE-2021-4048 suppress
An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory. CWE-125 Out-of-bounds Read
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:P CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H References:
Vulnerable Software & Versions: (show all )
File Path: /root/.m2/repository/org/apache/arrow/arrow-format/0.10.0/arrow-format-0.10.0.jarMD5: 44fc2dc5d5691bbea3d2a321c96664d3SHA1: 85347ddea82e80b0aa14efd25aefb9a009d8ff0fSHA256: 21387bd6012d98bbc7083f349f9569dc4798cd72c5b7c9aa713092bbce1939ebReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name arrow-format High Vendor jar package name apache Highest Vendor jar package name arrow Highest Vendor Manifest extension-name org.apache.arrow Medium Vendor Manifest implementation-url http://arrow.apache.org/arrow-format/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.arrow Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest url http://arrow.apache.org/ Low Vendor pom artifactid arrow-format Highest Vendor pom artifactid arrow-format Low Vendor pom groupid org.apache.arrow Highest Vendor pom name Arrow Format High Vendor pom parent-artifactid arrow-java-root Low Product file name arrow-format High Product jar package name apache Highest Product jar package name arrow Highest Product Manifest extension-name org.apache.arrow Medium Product Manifest Implementation-Title Arrow Format High Product Manifest implementation-url http://arrow.apache.org/arrow-format/ Low Product Manifest specification-title Arrow Format Medium Product Manifest url http://arrow.apache.org/ Low Product pom artifactid arrow-format Highest Product pom groupid org.apache.arrow Highest Product pom name Arrow Format High Product pom parent-artifactid arrow-java-root Medium Version file version 0.10.0 High Version Manifest Implementation-Version 0.10.0 High Version pom version 0.10.0 Highest
Related Dependencies arrow-memory-0.10.0.jarFile Path: /root/.m2/repository/org/apache/arrow/arrow-memory/0.10.0/arrow-memory-0.10.0.jar MD5: 6d8c913fbcdea6e33a2931867ebdc1b3 SHA1: d9301e56042f0734b5844ddf265d1f044ae0c6d8 SHA256: 84bfe57d112717b355dc201abaeb60ceb0750b9a77d4814088b52606981337c1 pkg:maven/org.apache.arrow/arrow-memory@0.10.0 arrow-vector-0.10.0.jarFile Path: /root/.m2/repository/org/apache/arrow/arrow-vector/0.10.0/arrow-vector-0.10.0.jar MD5: 378a5350739ed78eb18043f73049e73f SHA1: 1883c9bae9650ca76771dbbcbb4a8744070e5043 SHA256: 7e264f28f3b9c0351291a2415e4df5909243e44d75112439fd0d70878dec8b6c pkg:maven/org.apache.arrow/arrow-vector@0.10.0 File Path: /root/.m2/repository/asm/asm/3.1/asm-3.1.jarMD5: b9b8d2d556f9458aac8c463fd511f86dSHA1: c157def142714c544bdea2e6144645702adf7097SHA256: 333ff5369043975b7e031b8b27206937441854738e038c1f47f98d072a20437aReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name asm High Vendor jar package name asm Highest Vendor Manifest Implementation-Vendor France Telecom R&D High Vendor pom artifactid asm Highest Vendor pom artifactid asm Low Vendor pom groupid asm Highest Vendor pom name ASM Core High Vendor pom parent-artifactid asm-parent Low Product file name asm High Product jar package name asm Highest Product Manifest Implementation-Title ASM High Product pom artifactid asm Highest Product pom groupid asm Highest Product pom name ASM Core High Product pom parent-artifactid asm-parent Medium Version file version 3.1 High Version Manifest Implementation-Version 3.1 High Version pom version 3.1 Highest
Description:
The Async Http Client (AHC) classes. License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/asynchttpclient/async-http-client/2.10.1/async-http-client-2.10.1.jar
MD5: cc668461a45dcee1fa71231affd81554
SHA1: e016d72930c533438bfb4754b07bc99e5a8e9b5f
SHA256: 8baace97a3d523fd3898fa6a1b53bdb99e5a0b1d4e55389f7ce9dc5b5d5c185d
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name async-http-client High Vendor jar package name asynchttpclient Highest Vendor Manifest bundle-symbolicname org.asynchttpclient.async-http-client Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid async-http-client Highest Vendor pom artifactid async-http-client Low Vendor pom groupid org.asynchttpclient Highest Vendor pom name Asynchronous Http Client High Vendor pom parent-artifactid async-http-client-project Low Product file name async-http-client High Product jar package name asynchttpclient Highest Product jar package name filter Highest Product Manifest Bundle-Name Asynchronous Http Client Medium Product Manifest bundle-symbolicname org.asynchttpclient.async-http-client Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid async-http-client Highest Product pom groupid org.asynchttpclient Highest Product pom name Asynchronous Http Client High Product pom parent-artifactid async-http-client-project Medium Version file version 2.10.1 High Version Manifest Bundle-Version 2.10.1 High Version pom version 2.10.1 Highest
Description:
The Async Http Client (AHC) library's purpose is to allow Java applications to easily execute HTTP requests and asynchronously process the response. License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/asynchttpclient/async-http-client-netty-utils/2.10.1/async-http-client-netty-utils-2.10.1.jar
MD5: e2da6a17c8c9a0e30ef67a51d1f2a37d
SHA1: f365b035c75e12ddb444724417e7f78e0f96e9c2
SHA256: 6ffec083e27b4fa5f256edf3ad64203618298530f4cb0839ded6b22f9f7d5bb6
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name async-http-client-netty-utils High Vendor jar package name asynchttpclient Highest Vendor jar package name netty Highest Vendor Manifest bundle-symbolicname org.asynchttpclient.async-http-client-netty-utils Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid async-http-client-netty-utils Highest Vendor pom artifactid async-http-client-netty-utils Low Vendor pom groupid org.asynchttpclient Highest Vendor pom name Asynchronous Http Client Netty Utils High Vendor pom parent-artifactid async-http-client-project Low Product file name async-http-client-netty-utils High Product jar package name asynchttpclient Highest Product jar package name netty Highest Product Manifest Bundle-Name Asynchronous Http Client Netty Utils Medium Product Manifest bundle-symbolicname org.asynchttpclient.async-http-client-netty-utils Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid async-http-client-netty-utils Highest Product pom groupid org.asynchttpclient Highest Product pom name Asynchronous Http Client Netty Utils High Product pom parent-artifactid async-http-client-project Medium Version file version 2.10.1 High Version Manifest Bundle-Version 2.10.1 High Version pom version 2.10.1 Highest
Description:
Avro core components File Path: /root/.m2/repository/org/apache/avro/avro/1.7.4/avro-1.7.4.jarMD5: de02dfb1f5880c0b422f215ffcaa3379SHA1: 416e7030879814f52845b97f04bb50ecd1cef372SHA256: a01d26e9a5ed0754e8c88dbb373fba896c57df0a0c424185767a3857855bb222Referenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name avro High Vendor jar package name apache Highest Vendor jar package name avro Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.avro Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid avro Highest Vendor pom artifactid avro Low Vendor pom groupid org.apache.avro Highest Vendor pom name Apache Avro High Vendor pom parent-artifactid avro-parent Low Vendor pom url http://avro.apache.org Highest Product file name avro High Product jar package name apache Highest Product jar package name avro Highest Product Manifest Implementation-Title Apache Avro High Product Manifest specification-title Apache Avro Medium Product pom artifactid avro Highest Product pom groupid org.apache.avro Highest Product pom name Apache Avro High Product pom parent-artifactid avro-parent Medium Product pom url http://avro.apache.org Medium Version file version 1.7.4 High Version Manifest Implementation-Version 1.7.4 High Version pom version 1.7.4 Highest
CVE-2021-43045 suppress
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
Description:
Temporary artifact of guava dependencies File Path: /root/.m2/repository/org/apache/avro/avro/1.8.2/avro-1.8.2.jar/META-INF/maven/org.apache.avro/avro-guava-dependencies/pom.xmlMD5: 1117ab0e3aa409849f56cb09776d930eSHA1: 23d4a56f8c32dbfd25bf866f626ebfa4a65e7fcfSHA256: d0b0d846cc6327f8c4845d56f4471603287eb83ce2e116fa79795042761c2486Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid avro-guava-dependencies Low Vendor pom groupid org.apache.avro Highest Vendor pom name Apache Avro Guava Dependencies High Vendor pom parent-artifactid avro-parent Low Vendor pom url http://avro.apache.org Highest Product pom artifactid avro-guava-dependencies Highest Product pom groupid org.apache.avro Highest Product pom name Apache Avro Guava Dependencies High Product pom parent-artifactid avro-parent Medium Product pom url http://avro.apache.org Medium Version pom version 1.8.2 Highest
CVE-2021-43045 suppress
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
Description:
Avro core components License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/avro/avro/1.8.2/avro-1.8.2.jar
MD5: 10395e5a571e1a1f6113411f276d2fea
SHA1: 91e3146dfff4bd510181032c8276a3a0130c0697
SHA256: f754a0830ce67a5a9fa67a54ec15d103ef15e1c850d7b26faf7b647eeddc82d3
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name avro High Vendor jar package name apache Highest Vendor jar package name avro Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname avro Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.avro Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid avro Highest Vendor pom artifactid avro Low Vendor pom groupid org.apache.avro Highest Vendor pom name Apache Avro High Vendor pom parent-artifactid avro-parent Low Vendor pom url http://avro.apache.org Highest Product file name avro High Product jar package name apache Highest Product jar package name avro Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Apache Avro Medium Product Manifest bundle-symbolicname avro Medium Product Manifest Implementation-Title Apache Avro High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest specification-title Apache Avro Medium Product pom artifactid avro Highest Product pom groupid org.apache.avro Highest Product pom name Apache Avro High Product pom parent-artifactid avro-parent Medium Product pom url http://avro.apache.org Medium Version file version 1.8.2 High Version Manifest Bundle-Version 1.8.2 High Version Manifest Implementation-Version 1.8.2 High Version pom version 1.8.2 Highest
Related Dependencies avro-ipc-1.8.2.jarFile Path: /root/.m2/repository/org/apache/avro/avro-ipc/1.8.2/avro-ipc-1.8.2.jar MD5: d5068bf37b2a4072497bb1203522d104 SHA1: f4b0a97be342337431dada7b3c8d8cd62993684c SHA256: cef78adb0908473e3b589b95be56dad6923f2ce52d484d32f2dd306c2279d5f1 pkg:maven/org.apache.avro/avro-ipc@1.8.2 avro-mapred-1.8.2-hadoop2.jarFile Path: /root/.m2/repository/org/apache/avro/avro-mapred/1.8.2/avro-mapred-1.8.2-hadoop2.jar MD5: 1cfe4e66985b9d12a19255bb289719e6 SHA1: 8d31caedebfc3f8801981b0f5b501a673eca1bb6 SHA256: 67bfe847cec4890eb7e150841e99cf362733aea18c03af0486b84b7365126508 pkg:maven/org.apache.avro/avro-mapred@1.8.2 CVE-2021-43045 suppress
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
Description:
Lightweight connection pool. License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/com/jolbox/bonecp/0.8.0.RELEASE/bonecp-0.8.0.RELEASE.jar
MD5: 730a2f3602f5f4c3ff7590b08205adce
SHA1: cec24ee9345b3678472bb1b8fdd6aa6b9428beb8
SHA256: a53d5b5a7ba6433fc7c29e29664313e50ddb53e7381698c41d1091e3c3d081fb
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name bonecp High Vendor jar package name bonecp Highest Vendor jar package name jolbox Highest Vendor Manifest bundle-docurl http://jolbox.com Low Vendor Manifest bundle-symbolicname com.jolbox.bonecp Medium Vendor pom artifactid bonecp Highest Vendor pom artifactid bonecp Low Vendor pom groupid com.jolbox Highest Vendor pom name BoneCP :: Core Library High Vendor pom parent-artifactid bonecp-parent Low Product file name bonecp High Product jar package name bonecp Highest Product jar package name jolbox Highest Product Manifest bundle-docurl http://jolbox.com Low Product Manifest Bundle-Name BoneCP :: Core Library Medium Product Manifest bundle-symbolicname com.jolbox.bonecp Medium Product pom artifactid bonecp Highest Product pom groupid com.jolbox Highest Product pom name BoneCP :: Core Library High Product pom parent-artifactid bonecp-parent Medium Version Manifest Bundle-Version 0.8.0.RELEASE High Version pom version 0.8.0.RELEASE Highest
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/bootstrap.min.jsMD5: 2f34b630ffe30ba2ff2b91e3f3c322a1SHA1: b16fd8226bd6bfb08e568f1b1d0a21d60247cefbSHA256: 9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afeReferenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
breeze-macros License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/scalanlp/breeze-macros_2.11/0.13.2/breeze-macros_2.11-0.13.2.jar
MD5: a6688faa09ad9e4ea4fe711e620c8003
SHA1: b079266f280c98e710c20dfa7d892c28ab217ee4
SHA256: 87c9ff48595bea3ecb5507363e37dad58bc13e29d96a06995d8514c9fd71bb32
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name breeze-macros_2.11-0.13.2 High Vendor jar package name breeze Highest Vendor jar package name macros Highest Vendor Manifest Implementation-Vendor org.scalanlp High Vendor Manifest Implementation-Vendor-Id org.scalanlp Medium Vendor Manifest specification-vendor org.scalanlp Low Vendor pom artifactid breeze-macros_2.11 Highest Vendor pom artifactid breeze-macros_2.11 Low Vendor pom developer id dlwh Medium Vendor pom developer name David Hall Medium Vendor pom groupid org.scalanlp Highest Vendor pom name breeze-macros High Vendor pom organization name org.scalanlp High Vendor pom url http://scalanlp.org/ Highest Product file name breeze-macros_2.11-0.13.2 High Product jar package name breeze Highest Product jar package name macros Highest Product Manifest Implementation-Title breeze-macros High Product Manifest specification-title breeze-macros Medium Product pom artifactid breeze-macros_2.11 Highest Product pom developer id dlwh Low Product pom developer name David Hall Low Product pom groupid org.scalanlp Highest Product pom name breeze-macros High Product pom organization name org.scalanlp Low Product pom url http://scalanlp.org/ Medium Version Manifest Implementation-Version 0.13.2 High Version pom version 0.13.2 Highest
Description:
breeze-macros License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/scalanlp/breeze-macros_2.12/0.13.2/breeze-macros_2.12-0.13.2.jar
MD5: 7f94ee105a59dc721e135de3f5ee1dd3
SHA1: 2c2f4ed921b1564de17b63b996d102b9ccc91f16
SHA256: 90ada170dd3617638d4d93cdd64bf7f3d837f4a8046be25e84ca20e5ed89321f
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name breeze-macros_2.12-0.13.2 High Vendor jar package name breeze Highest Vendor jar package name macros Highest Vendor Manifest Implementation-Vendor org.scalanlp High Vendor Manifest Implementation-Vendor-Id org.scalanlp Medium Vendor Manifest specification-vendor org.scalanlp Low Vendor pom artifactid breeze-macros_2.12 Highest Vendor pom artifactid breeze-macros_2.12 Low Vendor pom developer id dlwh Medium Vendor pom developer name David Hall Medium Vendor pom groupid org.scalanlp Highest Vendor pom name breeze-macros High Vendor pom organization name org.scalanlp High Vendor pom url http://scalanlp.org/ Highest Product file name breeze-macros_2.12-0.13.2 High Product jar package name breeze Highest Product jar package name macros Highest Product Manifest Implementation-Title breeze-macros High Product Manifest specification-title breeze-macros Medium Product pom artifactid breeze-macros_2.12 Highest Product pom developer id dlwh Low Product pom developer name David Hall Low Product pom groupid org.scalanlp Highest Product pom name breeze-macros High Product pom organization name org.scalanlp Low Product pom url http://scalanlp.org/ Medium Version Manifest Implementation-Version 0.13.2 High Version pom version 0.13.2 Highest
Description:
breeze License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/scalanlp/breeze_2.11/0.13.2/breeze_2.11-0.13.2.jar
MD5: 21e286c5b6c31b76ee033ba8a0ee4511
SHA1: 4ead72f6bff9a6b7f2c16ca840f55db2b78b3922
SHA256: 9a18fbf07affaee3174e16109a990c15982b2629a391c95ad916c838830fc891
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name breeze_2.11-0.13.2 High Vendor jar package name breeze Highest Vendor Manifest Implementation-Vendor org.scalanlp High Vendor Manifest Implementation-Vendor-Id org.scalanlp Medium Vendor Manifest specification-vendor org.scalanlp Low Vendor pom artifactid breeze_2.11 Highest Vendor pom artifactid breeze_2.11 Low Vendor pom developer id dlwh Medium Vendor pom developer name David Hall Medium Vendor pom groupid org.scalanlp Highest Vendor pom name breeze High Vendor pom organization name org.scalanlp High Vendor pom url http://scalanlp.org/ Highest Product file name breeze_2.11-0.13.2 High Product jar package name breeze Highest Product Manifest Implementation-Title breeze High Product Manifest specification-title breeze Medium Product pom artifactid breeze_2.11 Highest Product pom developer id dlwh Low Product pom developer name David Hall Low Product pom groupid org.scalanlp Highest Product pom name breeze High Product pom organization name org.scalanlp Low Product pom url http://scalanlp.org/ Medium Version Manifest Implementation-Version 0.13.2 High Version pom version 0.13.2 Highest
Description:
breeze License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/scalanlp/breeze_2.12/0.13.2/breeze_2.12-0.13.2.jar
MD5: fafaccde16ffba3ff5dd85321cb0e8c0
SHA1: 9f70553f79824eda6afb5e681dfa30788c5c6be7
SHA256: e52ac9bfcd3b12287632c5eb3e3f77251c863e0c66c3f566da739e2f0fa0cd47
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name breeze_2.12-0.13.2 High Vendor jar package name breeze Highest Vendor Manifest Implementation-Vendor org.scalanlp High Vendor Manifest Implementation-Vendor-Id org.scalanlp Medium Vendor Manifest specification-vendor org.scalanlp Low Vendor pom artifactid breeze_2.12 Highest Vendor pom artifactid breeze_2.12 Low Vendor pom developer id dlwh Medium Vendor pom developer name David Hall Medium Vendor pom groupid org.scalanlp Highest Vendor pom name breeze High Vendor pom organization name org.scalanlp High Vendor pom url http://scalanlp.org/ Highest Product file name breeze_2.12-0.13.2 High Product jar package name breeze Highest Product Manifest Implementation-Title breeze High Product Manifest specification-title breeze Medium Product pom artifactid breeze_2.12 Highest Product pom developer id dlwh Low Product pom developer name David Hall Low Product pom groupid org.scalanlp Highest Product pom name breeze High Product pom organization name org.scalanlp Low Product pom url http://scalanlp.org/ Medium Version Manifest Implementation-Version 0.13.2 High Version pom version 0.13.2 Highest
Description:
Byte Buddy is a Java library for creating Java classes at run time.
This artifact is a build of Byte Buddy with a remaining dependency onto ASM.
You should never depend on this module without repackaging Byte Buddy and ASM into your own namespace.
File Path: /root/.m2/repository/net/bytebuddy/byte-buddy/1.6.11/byte-buddy-1.6.11.jar/META-INF/maven/net.bytebuddy/byte-buddy-dep/pom.xmlMD5: 21962ff4f38fe6bf7a826a676e853c56SHA1: d1832d62496ba1d311e82693d0a5b39f6d2c8280SHA256: 0ad262d6099669fc43963b11a4bb9815ad5b33116c5a9223ea3c58b2c15baebcReferenced In Project/Scope: livy-integration-test:runtime
Evidence Type Source Name Value Confidence Vendor pom artifactid byte-buddy-dep Low Vendor pom groupid net.bytebuddy Highest Vendor pom name Byte Buddy (with dependencies) High Vendor pom parent-artifactid byte-buddy-parent Low Product pom artifactid byte-buddy-dep Highest Product pom groupid net.bytebuddy Highest Product pom name Byte Buddy (with dependencies) High Product pom parent-artifactid byte-buddy-parent Medium Version pom version 1.6.11 Highest
Description:
Byte Buddy is a Java library for creating Java classes at run time.
This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/net/bytebuddy/byte-buddy/1.6.11/byte-buddy-1.6.11.jar
MD5: abd404f008234647aa01336ca175bd49
SHA1: 8a8f9409e27f1d62c909c7eef2aa7b3a580b4901
SHA256: 8785a451b5581cf14239a9b290a7e4807baba8a5c613192dd915a84644849b87
Referenced In Project/Scope: livy-integration-test:runtime
Evidence Type Source Name Value Confidence Vendor file name byte-buddy High Vendor jar package name asm Highest Vendor jar package name build Highest Vendor jar package name bytebuddy Highest Vendor jar package name net Highest Vendor Manifest bundle-symbolicname net.bytebuddy.byte-buddy Medium Vendor pom artifactid byte-buddy Highest Vendor pom artifactid byte-buddy Low Vendor pom groupid net.bytebuddy Highest Vendor pom name Byte Buddy (without dependencies) High Vendor pom parent-artifactid byte-buddy-parent Low Product file name byte-buddy High Product jar package name asm Highest Product jar package name build Highest Product jar package name bytebuddy Highest Product jar package name net Highest Product Manifest Bundle-Name Byte Buddy (without dependencies) Medium Product Manifest bundle-symbolicname net.bytebuddy.byte-buddy Medium Product pom artifactid byte-buddy Highest Product pom groupid net.bytebuddy Highest Product pom name Byte Buddy (without dependencies) High Product pom parent-artifactid byte-buddy-parent Medium Version file version 1.6.11 High Version Manifest Bundle-Version 1.6.11 High Version pom version 1.6.11 Highest
Description:
The Byte Buddy Java agent allows to access the JVM's HotSwap feature. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/net/bytebuddy/byte-buddy-agent/1.6.11/byte-buddy-agent-1.6.11.jar
MD5: ce085675a5ab47e5a406afb5933c2b8c
SHA1: 0200d9c012befccd211ff91082a151257b1dc084
SHA256: d8d9576b9fe1c8ebaed3594d7923ecc198e14cfbdc1655aa4ac63adeea030fc4
Referenced In Project/Scope: livy-integration-test:runtime
Evidence Type Source Name Value Confidence Vendor file name byte-buddy-agent High Vendor jar package name agent Highest Vendor jar package name bytebuddy Highest Vendor jar package name net Highest Vendor Manifest bundle-symbolicname net.bytebuddy.byte-buddy-agent Medium Vendor Manifest can-redefine-classes true Low Vendor Manifest can-retransform-classes true Low Vendor Manifest can-set-native-method-prefix true Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid byte-buddy-agent Highest Vendor pom artifactid byte-buddy-agent Low Vendor pom groupid net.bytebuddy Highest Vendor pom name Byte Buddy Java agent High Vendor pom parent-artifactid byte-buddy-parent Low Product file name byte-buddy-agent High Product jar package name agent Highest Product jar package name bytebuddy Highest Product jar package name net Highest Product Manifest Bundle-Name Byte Buddy Java agent Medium Product Manifest bundle-symbolicname net.bytebuddy.byte-buddy-agent Medium Product Manifest can-redefine-classes true Low Product Manifest can-retransform-classes true Low Product Manifest can-set-native-method-prefix true Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid byte-buddy-agent Highest Product pom groupid net.bytebuddy Highest Product pom name Byte Buddy Java agent High Product pom parent-artifactid byte-buddy-parent Medium Version file version 1.6.11 High Version Manifest Bundle-Version 1.6.11 High Version pom version 1.6.11 Highest
Description:
JDBC driver framework. File Path: /root/.m2/repository/org/apache/calcite/calcite-avatica/1.2.0-incubating/calcite-avatica-1.2.0-incubating.jarMD5: 2ae66375cfb806d72ee628caa7b3e6ecSHA1: 449432909cb395700a7293cb4147b4230124fd9dSHA256: f3ad4ac66d01e0288e32c950b9ab5dca935643112059705e6395904646912f2aReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name calcite-avatica High Vendor jar package name apache Highest Vendor jar package name avatica Highest Vendor jar package name calcite Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.calcite Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid calcite-avatica Highest Vendor pom artifactid calcite-avatica Low Vendor pom groupid org.apache.calcite Highest Vendor pom name Calcite Avatica High Vendor pom parent-artifactid calcite Low Product file name calcite-avatica High Product jar package name apache Highest Product jar package name avatica Highest Product jar package name calcite Highest Product Manifest Implementation-Title Calcite Avatica High Product Manifest specification-title Calcite Avatica Medium Product pom artifactid calcite-avatica Highest Product pom groupid org.apache.calcite Highest Product pom name Calcite Avatica High Product pom parent-artifactid calcite Medium Version Manifest Implementation-Version 1.2.0-incubating High Version pom version 1.2.0-incubating Highest
CVE-2022-39135 suppress
In Apache Calcite prior to version 1.32.0 the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, which makes them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators. CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2022-36364 suppress
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor. CWE-665 Improper Initialization
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-13955 suppress
HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Core Calcite APIs and engine. File Path: /root/.m2/repository/org/apache/calcite/calcite-core/1.2.0-incubating/calcite-core-1.2.0-incubating.jarMD5: 7650597181c7bb103d569958a667e631SHA1: 48fbc72e0c33026e53ab2272bafa4917ff598693SHA256: 36e2542170fad78360076d9b62b705211b9c3c39e2ddfbceb7ef9a2b86896b90Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name calcite-core High Vendor jar package name apache Highest Vendor jar package name calcite Highest Vendor jar package name core Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.calcite Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid calcite-core Highest Vendor pom artifactid calcite-core Low Vendor pom groupid org.apache.calcite Highest Vendor pom name Calcite Core High Vendor pom parent-artifactid calcite Low Product file name calcite-core High Product jar package name apache Highest Product jar package name calcite Highest Product jar package name core Highest Product Manifest Implementation-Title Calcite Core High Product Manifest specification-title Calcite Core Medium Product pom artifactid calcite-core Highest Product pom groupid org.apache.calcite Highest Product pom name Calcite Core High Product pom parent-artifactid calcite Medium Version Manifest Implementation-Version 1.2.0-incubating High Version pom version 1.2.0-incubating Highest
Related Dependencies calcite-linq4j-1.2.0-incubating.jarFile Path: /root/.m2/repository/org/apache/calcite/calcite-linq4j/1.2.0-incubating/calcite-linq4j-1.2.0-incubating.jar MD5: 0736baf8ddee6a17b5978d551a30823e SHA1: e5370a39bafe076eeec8355b1cc0b09dec0137ec SHA256: cea748a995d048850eeb0e7569b5885dfb55dc28abfa3e57243c9b55d8434a74 pkg:maven/org.apache.calcite/calcite-linq4j@1.2.0-incubating CVE-2022-39135 suppress
In Apache Calcite prior to version 1.32.0 the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, which makes them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators. CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-13955 suppress
HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
chill-java License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/twitter/chill-java/0.9.3/chill-java-0.9.3.jar
MD5: c2c0a8d1e5f0502a238a42ce81e8ad44
SHA1: f7670c73b068b3beeba8f0ed284e08b8d38eae02
SHA256: a4ee44dd7eb33435766cd65f87027591c2871c9b09293fb1937ff09284d787cd
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name chill-java High Vendor jar package name chill Highest Vendor jar package name java Highest Vendor jar package name twitter Highest Vendor Manifest Implementation-Vendor com.twitter High Vendor Manifest Implementation-Vendor-Id com.twitter Medium Vendor Manifest specification-vendor com.twitter Low Vendor pom artifactid chill-java Highest Vendor pom artifactid chill-java Low Vendor pom developer id oscar Medium Vendor pom developer id sritchie Medium Vendor pom developer name Oscar Boykin Medium Vendor pom developer name Sam Ritchie Medium Vendor pom groupid com.twitter Highest Vendor pom name chill-java High Vendor pom organization name com.twitter High Vendor pom url twitter/chill Highest Product file name chill-java High Product jar package name chill Highest Product jar package name java Highest Product jar package name twitter Highest Product Manifest Implementation-Title chill-java High Product Manifest specification-title chill-java Medium Product pom artifactid chill-java Highest Product pom developer id oscar Low Product pom developer id sritchie Low Product pom developer name Oscar Boykin Low Product pom developer name Sam Ritchie Low Product pom groupid com.twitter Highest Product pom name chill-java High Product pom organization name com.twitter Low Product pom url twitter/chill High Version file version 0.9.3 High Version Manifest Implementation-Version 0.9.3 High Version pom version 0.9.3 Highest
Description:
chill License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/twitter/chill_2.11/0.9.3/chill_2.11-0.9.3.jar
MD5: 98de737188d11f3020516cb64c33eda3
SHA1: 432cc2832f1deee574535b3dbf7be0a478e9ab0f
SHA256: fc2c4327b0612d398b5aa304fb6133105c4bd0524c06f1519672534bff1bec2e
Referenced In Projects/Scopes: livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name chill_2.11-0.9.3 High Vendor jar package name chill Highest Vendor jar package name twitter Highest Vendor Manifest Implementation-Vendor com.twitter High Vendor Manifest Implementation-Vendor-Id com.twitter Medium Vendor Manifest specification-vendor com.twitter Low Vendor pom artifactid chill_2.11 Highest Vendor pom artifactid chill_2.11 Low Vendor pom developer id oscar Medium Vendor pom developer id sritchie Medium Vendor pom developer name Oscar Boykin Medium Vendor pom developer name Sam Ritchie Medium Vendor pom groupid com.twitter Highest Vendor pom name chill High Vendor pom organization name com.twitter High Vendor pom url twitter/chill Highest Product file name chill_2.11-0.9.3 High Product jar package name chill Highest Product jar package name twitter Highest Product Manifest Implementation-Title chill High Product Manifest specification-title chill Medium Product pom artifactid chill_2.11 Highest Product pom developer id oscar Low Product pom developer id sritchie Low Product pom developer name Oscar Boykin Low Product pom developer name Sam Ritchie Low Product pom groupid com.twitter Highest Product pom name chill High Product pom organization name com.twitter Low Product pom url twitter/chill High Version Manifest Implementation-Version 0.9.3 High Version pom version 0.9.3 Highest
Description:
chill License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/twitter/chill_2.12/0.9.3/chill_2.12-0.9.3.jar
MD5: 5b6ce66f7f0d955bdbd61a460dd0f1d2
SHA1: 4e4c0e7f25d3f9d4e479794fea51d4d4fcb39c91
SHA256: c8e9a81028161b5f34e0d322cd53e0a11214c9704748bd5e9a741ec42452f4c7
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-repl_2.12:provided Evidence Type Source Name Value Confidence Vendor file name chill_2.12-0.9.3 High Vendor jar package name chill Highest Vendor jar package name twitter Highest Vendor Manifest Implementation-Vendor com.twitter High Vendor Manifest Implementation-Vendor-Id com.twitter Medium Vendor Manifest specification-vendor com.twitter Low Vendor pom artifactid chill_2.12 Highest Vendor pom artifactid chill_2.12 Low Vendor pom developer id oscar Medium Vendor pom developer id sritchie Medium Vendor pom developer name Oscar Boykin Medium Vendor pom developer name Sam Ritchie Medium Vendor pom groupid com.twitter Highest Vendor pom name chill High Vendor pom organization name com.twitter High Vendor pom url twitter/chill Highest Product file name chill_2.12-0.9.3 High Product jar package name chill Highest Product jar package name twitter Highest Product Manifest Implementation-Title chill High Product Manifest specification-title chill Medium Product pom artifactid chill_2.12 Highest Product pom developer id oscar Low Product pom developer id sritchie Low Product pom developer name Oscar Boykin Low Product pom developer name Sam Ritchie Low Product pom groupid com.twitter Highest Product pom name chill High Product pom organization name com.twitter Low Product pom url twitter/chill High Version Manifest Implementation-Version 0.9.3 High Version pom version 0.9.3 Highest
File Path: /root/.m2/repository/commons-beanutils/commons-beanutils/1.7.0/commons-beanutils-1.7.0.jarMD5: 0f18acf5fa857f9959675e14d901a7ceSHA1: 5675fd96b29656504b86029551973d60fb41339bSHA256: 24bcaa20ccbdc7c856ce0c0aea144566943403e2e9f27bd9779cda1d76823ef4Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-beanutils High Vendor jar package name apache Highest Vendor jar package name beanutils Highest Vendor jar package name commons Highest Vendor Manifest extension-name org.apache.commons.beanutils Medium Vendor Manifest Implementation-Vendor Apache Software Foundation High Vendor Manifest specification-vendor Apache Software Foundation Low Vendor pom artifactid commons-beanutils Highest Vendor pom artifactid commons-beanutils Low Vendor pom groupid commons-beanutils Highest Product file name commons-beanutils High Product jar package name apache Highest Product jar package name beanutils Highest Product jar package name commons Highest Product Manifest extension-name org.apache.commons.beanutils Medium Product Manifest Implementation-Title org.apache.commons.beanutils High Product Manifest specification-title Jakarta Commons Beanutils Medium Product pom artifactid commons-beanutils Highest Product pom groupid commons-beanutils Highest Version file version 1.7.0 High Version pom version 1.7.0 Highest
CVE-2014-0114 suppress
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. CWE-20 Improper Input Validation
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P References:
Vulnerable Software & Versions: (show all )
CVE-2019-10086 suppress
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
File Path: /root/.m2/repository/commons-beanutils/commons-beanutils-core/1.8.0/commons-beanutils-core-1.8.0.jarMD5: a33ba25ae637909a97a60ff1d1b38857SHA1: 175dc721f87e4bc5cc0573f990e28c3cf9117508SHA256: 9038c7ddc61d3d8089eb5a52a24b430a202617d57d2d344a93b68e4eafefefdeReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name commons-beanutils-core High Vendor jar package name apache Highest Vendor jar package name beanutils Highest Vendor jar package name commons Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-beanutils-core Highest Vendor pom artifactid commons-beanutils-core Low Vendor pom groupid commons-beanutils Highest Vendor pom name Commons BeanUtils Core High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://commons.apache.org/beanutils/ Highest Product file name commons-beanutils-core High Product jar package name apache Highest Product jar package name beanutils Highest Product jar package name commons Highest Product Manifest Implementation-Title Commons BeanUtils Core High Product Manifest specification-title Commons BeanUtils Core Medium Product pom artifactid commons-beanutils-core Highest Product pom groupid commons-beanutils Highest Product pom name Commons BeanUtils Core High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://commons.apache.org/beanutils/ Medium Version file version 1.8.0 High Version Manifest Implementation-Version 1.8.0 High Version pom parent-version 1.8.0 Low Version pom version 1.8.0 Highest
CVE-2014-0114 suppress
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. CWE-20 Improper Input Validation
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P References:
Vulnerable Software & Versions: (show all )
CVE-2019-10086 suppress
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Commons CLI provides a simple API for presenting, processing and validating a command line interface.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-cli/commons-cli/1.2/commons-cli-1.2.jar
MD5: bfdcae1ff93f0c07d733f03bdce28c9e
SHA1: 2bf96b7aa8b611c177d329452af1dc933e14501c
SHA256: e7cd8951956d349b568b7ccfd4f5b2529a8c113e67c32b028f52ffda371259d9
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-cli High Vendor jar package name apache Highest Vendor jar package name cli Highest Vendor jar package name commons Highest Vendor Manifest bundle-docurl http://commons.apache.org/cli/ Low Vendor Manifest bundle-symbolicname org.apache.commons.cli Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-cli Highest Vendor pom artifactid commons-cli Low Vendor pom developer email bob@werken.com Low Vendor pom developer email jbjk@mac.com Low Vendor pom developer email jstrachan@apache.org Low Vendor pom developer email roxspring@imapmail.org Low Vendor pom developer id bob Medium Vendor pom developer id jkeyes Medium Vendor pom developer id jstrachan Medium Vendor pom developer id roxspring Medium Vendor pom developer name Bob McWhirter Medium Vendor pom developer name James Strachan Medium Vendor pom developer name John Keyes Medium Vendor pom developer name Rob Oxspring Medium Vendor pom developer org Indigo Stone Medium Vendor pom developer org integral Source Medium Vendor pom developer org SpiritSoft, Inc. Medium Vendor pom developer org Werken Medium Vendor pom groupid commons-cli Highest Vendor pom name Commons CLI High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/cli/ Highest Product file name commons-cli High Product jar package name apache Highest Product jar package name cli Highest Product jar package name commons Highest Product Manifest bundle-docurl http://commons.apache.org/cli/ Low Product Manifest Bundle-Name Commons CLI Medium Product Manifest bundle-symbolicname org.apache.commons.cli Medium Product Manifest Implementation-Title Commons CLI High Product Manifest specification-title Commons CLI Medium Product pom artifactid commons-cli Highest Product pom developer email bob@werken.com Low Product pom developer email jbjk@mac.com Low Product pom developer email jstrachan@apache.org Low Product pom developer email roxspring@imapmail.org Low Product pom developer id bob Low Product pom developer id jkeyes Low Product pom developer id jstrachan Low Product pom developer id roxspring Low Product pom developer name Bob McWhirter Low Product pom developer name James Strachan Low Product pom developer name John Keyes Low Product pom developer name Rob Oxspring Low Product pom developer org Indigo Stone Low Product pom developer org integral Source Low Product pom developer org SpiritSoft, Inc. Low Product pom developer org Werken Low Product pom groupid commons-cli Highest Product pom name Commons CLI High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/cli/ Medium Version file version 1.2 High Version Manifest Bundle-Version 1.2 High Version Manifest Implementation-Version 1.2 High Version pom parent-version 1.2 Low Version pom version 1.2 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
MD5: 75615356605c8128013da9e3ac62a249
SHA1: 9ce04e34240f674bc72680f8b843b1457383161a
SHA256: ad19d2601c3abf0b946b5c3a4113e226a8c1e3305e395b90013b78dd94a723ce
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name commons-codec High Vendor jar package name apache Highest Vendor jar package name codec Highest Vendor jar package name commons Highest Vendor jar package name encoder Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Vendor Manifest bundle-symbolicname org.apache.commons.codec Medium Vendor Manifest implementation-build tags/1.9-RC1@r1552874; 2013-12-20 22:56:50-0500 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-codec Highest Vendor pom artifactid commons-codec Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email dgraham@apache.org Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ggregory@apache.org Low Vendor pom developer email jon@collab.net Low Vendor pom developer email julius@apache.org Low Vendor pom developer email rwaldhoff@apache.org Low Vendor pom developer email sanders@totalsync.com Low Vendor pom developer email tn@apache.org Low Vendor pom developer email tobrien@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id dgraham Medium Vendor pom developer id dlr Medium Vendor pom developer id ggregory Medium Vendor pom developer id jon Medium Vendor pom developer id julius Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sanders Medium Vendor pom developer id tn Medium Vendor pom developer id tobrien Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name David Graham Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name Jon S. Stevens Medium Vendor pom developer name Julius Davies Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Thomas Neidhart Medium Vendor pom developer name Tim OBrien Medium Vendor pom developer org URL http://juliusdavies.ca/ Medium Vendor pom groupid commons-codec Highest Vendor pom name Apache Commons Codec High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/proper/commons-codec/ Highest Product file name commons-codec High Product jar package name apache Highest Product jar package name codec Highest Product jar package name commons Highest Product jar package name encoder Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Product Manifest Bundle-Name Apache Commons Codec Medium Product Manifest bundle-symbolicname org.apache.commons.codec Medium Product Manifest implementation-build tags/1.9-RC1@r1552874; 2013-12-20 22:56:50-0500 Low Product Manifest Implementation-Title Apache Commons Codec High Product Manifest specification-title Apache Commons Codec Medium Product pom artifactid commons-codec Highest Product pom developer email bayard@apache.org Low Product pom developer email dgraham@apache.org Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ggregory@apache.org Low Product pom developer email jon@collab.net Low Product pom developer email julius@apache.org Low Product pom developer email rwaldhoff@apache.org Low Product pom developer email sanders@totalsync.com Low Product pom developer email tn@apache.org Low Product pom developer email tobrien@apache.org Low Product pom developer id bayard Low Product pom developer id dgraham Low Product pom developer id dlr Low Product pom developer id ggregory Low Product pom developer id jon Low Product pom developer id julius Low Product pom developer id rwaldhoff Low Product pom developer id sanders Low Product pom developer id tn Low Product pom developer id tobrien Low Product pom developer name Daniel Rall Low Product pom developer name David Graham Low Product pom developer name Gary Gregory Low Product pom developer name Henri Yandell Low Product pom developer name Jon S. Stevens Low Product pom developer name Julius Davies Low Product pom developer name Rodney Waldhoff Low Product pom developer name Scott Sanders Low Product pom developer name Thomas Neidhart Low Product pom developer name Tim OBrien Low Product pom developer org URL http://juliusdavies.ca/ Low Product pom groupid commons-codec Highest Product pom name Apache Commons Codec High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/proper/commons-codec/ Medium Version file version 1.9 High Version Manifest Implementation-Version 1.9 High Version pom parent-version 1.9 Low Version pom version 1.9 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Types that extend and augment the Java Collections Framework. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
SHA256: eeeae917917144a68a741d4c0dff66aa5c5c5fd85593ff217bced3fc8ca783b8
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-collections High Vendor jar package name apache Highest Vendor jar package name collections Highest Vendor jar package name commons Highest Vendor Manifest bundle-docurl http://commons.apache.org/collections/ Low Vendor Manifest bundle-symbolicname org.apache.commons.collections Medium Vendor Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Vendor Manifest implementation-url http://commons.apache.org/collections/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-collections Highest Vendor pom artifactid commons-collections Low Vendor pom developer id amamment Medium Vendor pom developer id bayard Medium Vendor pom developer id craigmcc Medium Vendor pom developer id geirm Medium Vendor pom developer id jcarman Medium Vendor pom developer id matth Medium Vendor pom developer id morgand Medium Vendor pom developer id psteitz Medium Vendor pom developer id rdonkin Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id scolebourne Medium Vendor pom developer name Arun M. Thomas Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name Geir Magnusson Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name James Carman Medium Vendor pom developer name Matthew Hawthorne Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom groupid commons-collections Highest Vendor pom name Apache Commons Collections High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/collections/ Highest Product file name commons-collections High Product jar package name apache Highest Product jar package name collections Highest Product jar package name commons Highest Product Manifest bundle-docurl http://commons.apache.org/collections/ Low Product Manifest Bundle-Name Apache Commons Collections Medium Product Manifest bundle-symbolicname org.apache.commons.collections Medium Product Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Product Manifest Implementation-Title Apache Commons Collections High Product Manifest implementation-url http://commons.apache.org/collections/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Product Manifest specification-title Apache Commons Collections Medium Product pom artifactid commons-collections Highest Product pom developer id amamment Low Product pom developer id bayard Low Product pom developer id craigmcc Low Product pom developer id geirm Low Product pom developer id jcarman Low Product pom developer id matth Low Product pom developer id morgand Low Product pom developer id psteitz Low Product pom developer id rdonkin Low Product pom developer id rwaldhoff Low Product pom developer id scolebourne Low Product pom developer name Arun M. Thomas Low Product pom developer name Craig McClanahan Low Product pom developer name Geir Magnusson Low Product pom developer name Henri Yandell Low Product pom developer name James Carman Low Product pom developer name Matthew Hawthorne Low Product pom developer name Morgan Delagrange Low Product pom developer name Phil Steitz Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Rodney Waldhoff Low Product pom developer name Stephen Colebourne Low Product pom groupid commons-collections Highest Product pom name Apache Commons Collections High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/collections/ Medium Version file version 3.2.2 High Version Manifest Bundle-Version 3.2.2 High Version Manifest Implementation-Version 3.2.2 High Version pom parent-version 3.2.2 Low Version pom version 3.2.2 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The "commons-compiler" API, including the "IExpressionEvaluator", "IScriptEvaluator", "IClassBodyEvaluator" and "ISimpleCompiler" interfaces. License:
https://raw.githubusercontent.com/janino-compiler/janino/master/LICENSE File Path: /root/.m2/repository/org/codehaus/janino/commons-compiler/3.0.9/commons-compiler-3.0.9.jar
MD5: 8db21cabe3f77efc36498e43501a4b9d
SHA1: 6aac3c03d02dcab0d59f77ff00b682f5320e54e9
SHA256: d924418b051748034bae80f563499d5c0533c30383525f22aebbeb1d297b9e6e
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-compiler High Vendor jar package name codehaus Highest Vendor jar package name commons Highest Vendor jar package name compiler Highest Vendor jar package name iclassbodyevaluator Highest Vendor jar package name iexpressionevaluator Highest Vendor jar package name iscriptevaluator Highest Vendor jar package name isimplecompiler Highest Vendor Manifest bundle-symbolicname org.codehaus.janino.commons-compiler;singleton:=true Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid commons-compiler Highest Vendor pom artifactid commons-compiler Low Vendor pom groupid org.codehaus.janino Highest Vendor pom name commons-compiler High Vendor pom parent-artifactid janino-parent Low Product file name commons-compiler High Product jar package name codehaus Highest Product jar package name commons Highest Product jar package name compiler Highest Product jar package name iclassbodyevaluator Highest Product jar package name iexpressionevaluator Highest Product jar package name iscriptevaluator Highest Product jar package name isimplecompiler Highest Product Manifest Bundle-Name commons-compiler Medium Product Manifest bundle-symbolicname org.codehaus.janino.commons-compiler;singleton:=true Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid commons-compiler Highest Product pom groupid org.codehaus.janino Highest Product pom name commons-compiler High Product pom parent-artifactid janino-parent Medium Version file version 3.0.9 High Version Manifest Bundle-Version 3.0.9 High Version pom version 3.0.9 Highest
Description:
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-compress/1.4.1/commons-compress-1.4.1.jar
MD5: 7f7ff9255a831325f38a170992b70073
SHA1: b02e84a993d88568417536240e970c4b809126fd
SHA256: 28a00d80716f073d644b9da76e94b5e8ff94de8e9323f06f558fba653fcf5f86
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name commons-compress High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name compress Highest Vendor Manifest bundle-docurl http://commons.apache.org/compress/ Low Vendor Manifest bundle-symbolicname org.apache.commons.compress Medium Vendor Manifest extension-name org.apache.commons.compress Medium Vendor Manifest implementation-build trunk@r1341303; 2012-05-22 06:55:03+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-compress Highest Vendor pom artifactid commons-compress Low Vendor pom developer email bodewig at apache.org Low Vendor pom developer email grobmeier at apache.org Low Vendor pom developer email sebb at apache.org Low Vendor pom developer email tcurdt at apache.org Low Vendor pom developer id bodewig Medium Vendor pom developer id grobmeier Medium Vendor pom developer id sebb Medium Vendor pom developer id tcurdt Medium Vendor pom developer name Christian Grobmeier Medium Vendor pom developer name Sebastian Bazley Medium Vendor pom developer name Stefan Bodewig Medium Vendor pom developer name Torsten Curdt Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Commons Compress High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/compress/ Highest Product file name commons-compress High Product jar package name apache Highest Product jar package name commons Highest Product jar package name compress Highest Product Manifest bundle-docurl http://commons.apache.org/compress/ Low Product Manifest Bundle-Name Commons Compress Medium Product Manifest bundle-symbolicname org.apache.commons.compress Medium Product Manifest extension-name org.apache.commons.compress Medium Product Manifest implementation-build trunk@r1341303; 2012-05-22 06:55:03+0200 Low Product Manifest Implementation-Title Commons Compress High Product Manifest specification-title Commons Compress Medium Product pom artifactid commons-compress Highest Product pom developer email bodewig at apache.org Low Product pom developer email grobmeier at apache.org Low Product pom developer email sebb at apache.org Low Product pom developer email tcurdt at apache.org Low Product pom developer id bodewig Low Product pom developer id grobmeier Low Product pom developer id sebb Low Product pom developer id tcurdt Low Product pom developer name Christian Grobmeier Low Product pom developer name Sebastian Bazley Low Product pom developer name Stefan Bodewig Low Product pom developer name Torsten Curdt Low Product pom groupid org.apache.commons Highest Product pom name Commons Compress High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/compress/ Medium Version file version 1.4.1 High Version Manifest Bundle-Version 1.4.1 High Version Manifest Implementation-Version 1.4.1 High Version pom parent-version 1.4.1 Low Version pom version 1.4.1 Highest
CVE-2021-35517 suppress
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability MLIST - [announce] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [ant-user] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [flink-issues] 20210908 [GitHub] [flink] MartijnVisser opened a new pull request #17194: [FLINK-24034] Upgrade commons-compress to 1.21 and other apache.commons updates MLIST - [oss-security] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability MLIST - [oss-security] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) N/A - N/A OSSINDEX - [CVE-2021-35517] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35517 OSSIndex - https://github.com/OpenLiberty/open-liberty/issues/18808 OSSIndex - https://github.com/OpenLiberty/open-liberty/pull/17872 OSSIndex - https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E OSSIndex - https://openliberty.io/docs/latest/security-vulnerabilities.html Vulnerable Software & Versions: (show all )
CVE-2021-36090 suppress
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability MLIST - [announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) MLIST - [james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21 MLIST - [oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability MLIST - [oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) MLIST - [tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20 N/A - N/A OSSINDEX - [CVE-2021-36090] CWE-130: Improper Handling of Length Parameter Inconsistency OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36090 OSSIndex - https://commons.apache.org/proper/commons-compress/security-reports.html OSSIndex - https://github.com/OpenLiberty/open-liberty/issues/18808 OSSIndex - https://github.com/OpenLiberty/open-liberty/pull/17872 OSSIndex - https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E OSSIndex - https://openliberty.io/docs/latest/security-vulnerabilities.html Vulnerable Software & Versions: (show all )
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2018-11771 (OSSINDEX)suppress
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package. CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv2:
Base Score: MEDIUM (5.5) Vector: /AV:L/AC:L/Au:/C:N/I:N/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.apache.commons:commons-compress:1.4.1:*:*:*:*:*:*:* Description:
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress and ar, cpio, jar, tar, zip, dump, 7z, arj.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar
MD5: d862e30ff6b5d78264677dcd6507abb8
SHA1: a698750c16740fd5b3871425f4cb3bbaa87f529d
SHA256: 5fca136503f86ecc6cb61fbd17b137d59e56b45c7a5494e6b8fd3cabd4697fbd
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-compress High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name compress Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-compress/ Low Vendor Manifest bundle-symbolicname org.apache.commons.compress Medium Vendor Manifest extension-name org.apache.commons.compress Medium Vendor Manifest implementation-build trunk@r1593589; 2014-05-09 20:44:50+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-compress Highest Vendor pom artifactid commons-compress Low Vendor pom developer email bodewig at apache.org Low Vendor pom developer email damjan at apache.org Low Vendor pom developer email ebourg at apache.org Low Vendor pom developer email grobmeier at apache.org Low Vendor pom developer email julius at apache.org Low Vendor pom developer email sebb at apache.org Low Vendor pom developer email tcurdt at apache.org Low Vendor pom developer id bodewig Medium Vendor pom developer id damjan Medium Vendor pom developer id ebourg Medium Vendor pom developer id grobmeier Medium Vendor pom developer id julius Medium Vendor pom developer id sebb Medium Vendor pom developer id tcurdt Medium Vendor pom developer name Christian Grobmeier Medium Vendor pom developer name Damjan Jovanovic Medium Vendor pom developer name Emmanuel Bourg Medium Vendor pom developer name Julius Davies Medium Vendor pom developer name Sebastian Bazley Medium Vendor pom developer name Stefan Bodewig Medium Vendor pom developer name Torsten Curdt Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Compress High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-compress/ Highest Product file name commons-compress High Product jar package name apache Highest Product jar package name commons Highest Product jar package name compress Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-compress/ Low Product Manifest Bundle-Name Apache Commons Compress Medium Product Manifest bundle-symbolicname org.apache.commons.compress Medium Product Manifest extension-name org.apache.commons.compress Medium Product Manifest implementation-build trunk@r1593589; 2014-05-09 20:44:50+0200 Low Product Manifest Implementation-Title Apache Commons Compress High Product Manifest specification-title Apache Commons Compress Medium Product pom artifactid commons-compress Highest Product pom developer email bodewig at apache.org Low Product pom developer email damjan at apache.org Low Product pom developer email ebourg at apache.org Low Product pom developer email grobmeier at apache.org Low Product pom developer email julius at apache.org Low Product pom developer email sebb at apache.org Low Product pom developer email tcurdt at apache.org Low Product pom developer id bodewig Low Product pom developer id damjan Low Product pom developer id ebourg Low Product pom developer id grobmeier Low Product pom developer id julius Low Product pom developer id sebb Low Product pom developer id tcurdt Low Product pom developer name Christian Grobmeier Low Product pom developer name Damjan Jovanovic Low Product pom developer name Emmanuel Bourg Low Product pom developer name Julius Davies Low Product pom developer name Sebastian Bazley Low Product pom developer name Stefan Bodewig Low Product pom developer name Torsten Curdt Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Compress High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-compress/ Medium Version file version 1.8.1 High Version Manifest Bundle-Version 1.8.1 High Version Manifest Implementation-Version 1.8.1 High Version pom parent-version 1.8.1 Low Version pom version 1.8.1 Highest
CVE-2021-35515 suppress
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) MLIST - [oss-security] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) N/A - N/A OSSINDEX - [CVE-2021-35515] CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35515 OSSIndex - https://commons.apache.org/proper/commons-compress/security-reports.html OSSIndex - https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E Vulnerable Software & Versions: (show all )
CVE-2021-35516 suppress
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability MLIST - [oss-security] 20210713 CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) N/A - N/A OSSINDEX - [CVE-2021-35516] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35516 OSSIndex - https://commons.apache.org/proper/commons-compress/security-reports.html OSSIndex - https://issues.apache.org/jira/browse/COMPRESS-542 Vulnerable Software & Versions: (show all )
CVE-2021-35517 suppress
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability MLIST - [announce] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [ant-user] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [flink-issues] 20210908 [GitHub] [flink] MartijnVisser opened a new pull request #17194: [FLINK-24034] Upgrade commons-compress to 1.21 and other apache.commons updates MLIST - [oss-security] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability MLIST - [oss-security] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) N/A - N/A OSSINDEX - [CVE-2021-35517] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35517 OSSIndex - https://github.com/OpenLiberty/open-liberty/issues/18808 OSSIndex - https://github.com/OpenLiberty/open-liberty/pull/17872 OSSIndex - https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E OSSIndex - https://openliberty.io/docs/latest/security-vulnerabilities.html Vulnerable Software & Versions: (show all )
CVE-2021-36090 suppress
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://security.netapp.com/advisory/ntap-20211022-0001/ MISC - https://commons.apache.org/proper/commons-compress/security-reports.html MISC - https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability MLIST - [announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 MLIST - [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) MLIST - [james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21 MLIST - [oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability MLIST - [oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability MLIST - [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) MLIST - [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 MLIST - [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) MLIST - [tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20 N/A - N/A OSSINDEX - [CVE-2021-36090] CWE-130: Improper Handling of Length Parameter Inconsistency OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36090 OSSIndex - https://commons.apache.org/proper/commons-compress/security-reports.html OSSIndex - https://github.com/OpenLiberty/open-liberty/issues/18808 OSSIndex - https://github.com/OpenLiberty/open-liberty/pull/17872 OSSIndex - https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E OSSIndex - https://openliberty.io/docs/latest/security-vulnerabilities.html Vulnerable Software & Versions: (show all )
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2018-11771 suppress
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package. CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Tools to assist in the reading of configuration/preferences files in
various formats
License:
The Apache Software License, Version 2.0: /LICENSE.txt File Path: /root/.m2/repository/commons-configuration/commons-configuration/1.6/commons-configuration-1.6.jar
MD5: b099d9f9b4b99071cc52b259308df69a
SHA1: 32cadde23955d7681b0d94a2715846d20b425235
SHA256: 46b71b9656154f6a16ea4b1dc84026b52a9305f8eff046a2b4655fa1738e5eee
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-configuration High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name configuration Highest Vendor Manifest bundle-docurl http://commons.apache.org/configuration/ Low Vendor Manifest bundle-symbolicname org.apache.commons.configuration Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-configuration Highest Vendor pom artifactid commons-configuration Low Vendor pom developer email bdunbar@dunbarconsulting.org Low Vendor pom developer email dion@multitask.com.au Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ebourg@apache.org Low Vendor pom developer email epugh@upstate.com Low Vendor pom developer email hps@intermeta.de Low Vendor pom developer email jason@zenplex.com Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email mpoeschl@marmot.at Low Vendor pom developer email oheger@apache.org Low Vendor pom developer email rgoers@apache.org Low Vendor pom developer id bdunbar Medium Vendor pom developer id dion Medium Vendor pom developer id dlr Medium Vendor pom developer id ebourg Medium Vendor pom developer id epugh Medium Vendor pom developer id henning Medium Vendor pom developer id joehni Medium Vendor pom developer id jvanzyl Medium Vendor pom developer id mpoeschl Medium Vendor pom developer id oheger Medium Vendor pom developer id rgoers Medium Vendor pom developer name Brian E. Dunbar Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name dIon Gillard Medium Vendor pom developer name Emmanuel Bourg Medium Vendor pom developer name Eric Pugh Medium Vendor pom developer name Henning P. Schmiedehausen Medium Vendor pom developer name Jörg Schaible Medium Vendor pom developer name Jason van Zyl Medium Vendor pom developer name Jörg Schaible Medium Vendor pom developer name Martin Poeschl Medium Vendor pom developer name Oliver Heger Medium Vendor pom developer name Ralph Goers Medium Vendor pom developer org Agfa HealthCare Medium Vendor pom developer org Ariane Software Medium Vendor pom developer org CollabNet, Inc. Medium Vendor pom developer org dunbarconsulting.org Medium Vendor pom developer org INTERMETA - Gesellschaft fuer Mehrwertdienste mbH Medium Vendor pom developer org Intuit Medium Vendor pom developer org Multitask Consulting Medium Vendor pom developer org tucana.at Medium Vendor pom developer org upstate.com Medium Vendor pom developer org Zenplex Medium Vendor pom groupid commons-configuration Highest Vendor pom name Commons Configuration High Vendor pom organization name The Apache Software Foundation High Vendor pom organization url http://commons.apache.org/ Medium Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/${pom.artifactId.substring(8)}/ Highest Vendor pom url http://commons.apache.org/configuration/ Highest Product file name commons-configuration High Product jar package name apache Highest Product jar package name commons Highest Product jar package name configuration Highest Product Manifest bundle-docurl http://commons.apache.org/configuration/ Low Product Manifest Bundle-Name Commons Configuration Medium Product Manifest bundle-symbolicname org.apache.commons.configuration Medium Product Manifest Implementation-Title Commons Configuration High Product Manifest specification-title Commons Configuration Medium Product pom artifactid commons-configuration Highest Product pom developer email bdunbar@dunbarconsulting.org Low Product pom developer email dion@multitask.com.au Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ebourg@apache.org Low Product pom developer email epugh@upstate.com Low Product pom developer email hps@intermeta.de Low Product pom developer email jason@zenplex.com Low Product pom developer email joerg.schaible@gmx.de Low Product pom developer email mpoeschl@marmot.at Low Product pom developer email oheger@apache.org Low Product pom developer email rgoers@apache.org Low Product pom developer id bdunbar Low Product pom developer id dion Low Product pom developer id dlr Low Product pom developer id ebourg Low Product pom developer id epugh Low Product pom developer id henning Low Product pom developer id joehni Low Product pom developer id jvanzyl Low Product pom developer id mpoeschl Low Product pom developer id oheger Low Product pom developer id rgoers Low Product pom developer name Brian E. Dunbar Low Product pom developer name Daniel Rall Low Product pom developer name dIon Gillard Low Product pom developer name Emmanuel Bourg Low Product pom developer name Eric Pugh Low Product pom developer name Henning P. Schmiedehausen Low Product pom developer name Jörg Schaible Low Product pom developer name Jason van Zyl Low Product pom developer name Jörg Schaible Low Product pom developer name Martin Poeschl Low Product pom developer name Oliver Heger Low Product pom developer name Ralph Goers Low Product pom developer org Agfa HealthCare Low Product pom developer org Ariane Software Low Product pom developer org CollabNet, Inc. Low Product pom developer org dunbarconsulting.org Low Product pom developer org INTERMETA - Gesellschaft fuer Mehrwertdienste mbH Low Product pom developer org Intuit Low Product pom developer org Multitask Consulting Low Product pom developer org tucana.at Low Product pom developer org upstate.com Low Product pom developer org Zenplex Low Product pom groupid commons-configuration Highest Product pom name Commons Configuration High Product pom organization name The Apache Software Foundation Low Product pom organization url http://commons.apache.org/ Low Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/${pom.artifactId.substring(8)}/ Medium Product pom url http://commons.apache.org/configuration/ Medium Version file version 1.6 High Version Manifest Bundle-Version 1.6 High Version Manifest Implementation-Version 1.6 High Version pom parent-version 1.6 Low Version pom version 1.6 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Apache Commons Crypto is a cryptographic library optimized with AES-NI (Advanced Encryption Standard New Instructions). It provides Java API for both cipher level and Java stream level. Developers can use it to implement high performance AES encryption/decryption with the minimum code and effort. Please note that Crypto doesn't implement the cryptographic algorithm such as AES directly. It wraps to Openssl or JCE which implement the algorithms. Features -------- 1. Cipher API for low level cryptographic operations. 2. Java stream API (CryptoInputStream/CryptoOutputStream) for high level stream encyrption/decryption. 3. Both optimized with high performance AES encryption/decryption. (1400 MB/s - 1700 MB/s throughput in modern Xeon processors). 4. JNI-based implementation to achieve comparable performance to the native C++ version based on OpenSsl. 5. Portable across various operating systems (currently only Linux/MacOSX/Windows); Apache Commons Crypto loads the library according to your machine environment (it checks system properties, `os.name` and `os.arch`). 6. Simple usage. Add the commons-crypto-(version).jar file to your classpath. Export restrictions ------------------- This distribution includes cryptographic software. The country in which you currently reside may have restrictions on the import, possession, use, and/or re-export to another country, of encryption software. BEFORE using any encryption software, please check your country's laws, regulations and policies concerning the import, possession, or use, and re-export of encryption software, to see if this is permitted. See for more information. The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) 5D002.C.1, which includes information security software using or performing cryptographic functions with asymmetric algorithms. The form and manner of this Apache Software Foundation distribution makes it eligible for export under the License Exception ENC Technology Software Unrestricted (TSU) exception (see the BIS Export Administration Regulations, Section 740.13) for both object code and source code. The following provides more details on the included cryptographic software: * Commons Crypto use [Java Cryptography Extension](http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html) provided by Java * Commons Crypto link to and use [OpenSSL](https://www.openssl.org/) ciphers License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-crypto/1.0.0/commons-crypto-1.0.0.jar
MD5: 981c95e38457b10d429090496b96f2d6
SHA1: 7938f66b01f62f03ef8af8a64401e85e45d51c5d
SHA256: 0043d8d74d8df632c57f938828e6f6efd555e293a9079dcdf59eab8e40107491
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-crypto High Vendor jar package name apache Highest Vendor jar package name cipher Highest Vendor jar package name commons Highest Vendor jar package name crypto Highest Vendor jar package name stream Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-crypto/ Low Vendor Manifest bundle-symbolicname org.apache.commons.crypto Medium Vendor Manifest implementation-build CRYPTO-1.0.0@r782ca06a1f9a292756fbad9eb9841e685cd34af1; 2016-07-26 09:19:11+0800 Low Vendor Manifest implementation-url http://commons.apache.org/proper/commons-crypto/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-crypto Highest Vendor pom artifactid commons-crypto Low Vendor pom developer email atm@apache.org Low Vendor pom developer email cmccabe@apache.org Low Vendor pom developer email cnauroth@apache.org Low Vendor pom developer email dianfu@apache.org Low Vendor pom developer email dongc@apache.org Low Vendor pom developer email haifengchen@apache.org Low Vendor pom developer email sdp@apache.org Low Vendor pom developer email umamahesh@apache.org Low Vendor pom developer email vanzin@apache.org Low Vendor pom developer email wang@apache.org Low Vendor pom developer email xuf@apache.org Low Vendor pom developer email yliu@apache.org Low Vendor pom developer id atm Medium Vendor pom developer id cmccabe Medium Vendor pom developer id cnauroth Medium Vendor pom developer id dianfu Medium Vendor pom developer id dongc Medium Vendor pom developer id haifengchen Medium Vendor pom developer id sdp Medium Vendor pom developer id umamahesh Medium Vendor pom developer id vanzin Medium Vendor pom developer id wang Medium Vendor pom developer id xuf Medium Vendor pom developer id yliu Medium Vendor pom developer name Aaron T Myers Medium Vendor pom developer name Andrew Wang Medium Vendor pom developer name Chris Nauroth Medium Vendor pom developer name Colin P. McCabe Medium Vendor pom developer name Dapeng Sun Medium Vendor pom developer name Dian Fu Medium Vendor pom developer name Dong Chen Medium Vendor pom developer name Ferdinand Xu Medium Vendor pom developer name Haifeng Chen Medium Vendor pom developer name Marcelo Vanzin Medium Vendor pom developer name Uma Maheswara Rao G Medium Vendor pom developer name Yi Liu Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Crypto High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-crypto/ Highest Product file name commons-crypto High Product jar package name apache Highest Product jar package name cipher Highest Product jar package name commons Highest Product jar package name crypto Highest Product jar package name stream Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-crypto/ Low Product Manifest Bundle-Name Apache Commons Crypto Medium Product Manifest bundle-symbolicname org.apache.commons.crypto Medium Product Manifest implementation-build CRYPTO-1.0.0@r782ca06a1f9a292756fbad9eb9841e685cd34af1; 2016-07-26 09:19:11+0800 Low Product Manifest Implementation-Title Apache Commons Crypto High Product Manifest implementation-url http://commons.apache.org/proper/commons-crypto/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title Apache Commons Crypto Medium Product pom artifactid commons-crypto Highest Product pom developer email atm@apache.org Low Product pom developer email cmccabe@apache.org Low Product pom developer email cnauroth@apache.org Low Product pom developer email dianfu@apache.org Low Product pom developer email dongc@apache.org Low Product pom developer email haifengchen@apache.org Low Product pom developer email sdp@apache.org Low Product pom developer email umamahesh@apache.org Low Product pom developer email vanzin@apache.org Low Product pom developer email wang@apache.org Low Product pom developer email xuf@apache.org Low Product pom developer email yliu@apache.org Low Product pom developer id atm Low Product pom developer id cmccabe Low Product pom developer id cnauroth Low Product pom developer id dianfu Low Product pom developer id dongc Low Product pom developer id haifengchen Low Product pom developer id sdp Low Product pom developer id umamahesh Low Product pom developer id vanzin Low Product pom developer id wang Low Product pom developer id xuf Low Product pom developer id yliu Low Product pom developer name Aaron T Myers Low Product pom developer name Andrew Wang Low Product pom developer name Chris Nauroth Low Product pom developer name Colin P. McCabe Low Product pom developer name Dapeng Sun Low Product pom developer name Dian Fu Low Product pom developer name Dong Chen Low Product pom developer name Ferdinand Xu Low Product pom developer name Haifeng Chen Low Product pom developer name Marcelo Vanzin Low Product pom developer name Uma Maheswara Rao G Low Product pom developer name Yi Liu Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Crypto High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-crypto/ Medium Version file version 1.0.0 High Version Manifest Bundle-Version 1.0.0 High Version Manifest Implementation-Version 1.0.0 High Version pom parent-version 1.0.0 Low Version pom version 1.0.0 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
File Path: /root/.m2/repository/org/apache/commons/commons-crypto/1.0.0/commons-crypto-1.0.0.jar/org/apache/commons/crypto/native/Windows/x86/commons-crypto.dllMD5: 80df8a7e2032790a467db967ce60182eSHA1: 2a8efda075679e8a913347c52f409015b4ce2e96SHA256: 02e008efb98e14d5b1f16a2219f71ad179ff301bed5a2267883c28d74bcfe6beReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-crypto High Product file name commons-crypto High
File Path: /root/.m2/repository/org/apache/commons/commons-crypto/1.0.0/commons-crypto-1.0.0.jar/org/apache/commons/crypto/native/Windows/x86_64/commons-crypto.dllMD5: a330d40c0b4016e6fcff609473eeb44eSHA1: ed34492e05a31791856eaecdd436db9a875926ebSHA256: 6d8783ac18bc5f770af7371fcf9684af4b531cad982e62ffe508fca22afa573fReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-crypto High Product file name commons-crypto High
Description:
Apache Commons Daemon software provides an alternative invocation mechanism for unix-daemon-like Java code.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-daemon/commons-daemon/1.0.13/commons-daemon-1.0.13.jar
MD5: 686f1a2cc85f8f4e939bd3cd28c9720b
SHA1: 750856a1fdb3ddf721ccf73c3518e4211cffc3a3
SHA256: fd63b583fd3e8baeae22efacbd5a4f91c1fd97f56248e62e2615efa7b81daeaa
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name commons-daemon High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name daemon Highest Vendor Manifest bundle-docurl http://commons.apache.org/daemon/ Low Vendor Manifest bundle-symbolicname org.apache.commons.daemon Medium Vendor Manifest implementation-build UNKNOWN_BRANCH@r??????; 2013-02-06 19:20:07+0100 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-daemon Highest Vendor pom artifactid commons-daemon Low Vendor pom developer email billbarker at apache.org Low Vendor pom developer email jfclere at apache.org Low Vendor pom developer email mturk at apache.org Low Vendor pom developer email remm at apache.org Low Vendor pom developer email yoavs at apache.org Low Vendor pom developer id billbarker Medium Vendor pom developer id jfclere Medium Vendor pom developer id mturk Medium Vendor pom developer id remm Medium Vendor pom developer id yoavs Medium Vendor pom developer name Bill Barker Medium Vendor pom developer name Jean-Frederic Clere Medium Vendor pom developer name Mladen Turk Medium Vendor pom developer name Remy Maucherat Medium Vendor pom developer name Yoav Shapira Medium Vendor pom groupid commons-daemon Highest Vendor pom name Commons Daemon High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/daemon/ Highest Product file name commons-daemon High Product jar package name apache Highest Product jar package name commons Highest Product jar package name daemon Highest Product Manifest bundle-docurl http://commons.apache.org/daemon/ Low Product Manifest Bundle-Name Commons Daemon Medium Product Manifest bundle-symbolicname org.apache.commons.daemon Medium Product Manifest implementation-build UNKNOWN_BRANCH@r??????; 2013-02-06 19:20:07+0100 Low Product Manifest Implementation-Title Commons Daemon High Product Manifest specification-title Commons Daemon Medium Product pom artifactid commons-daemon Highest Product pom developer email billbarker at apache.org Low Product pom developer email jfclere at apache.org Low Product pom developer email mturk at apache.org Low Product pom developer email remm at apache.org Low Product pom developer email yoavs at apache.org Low Product pom developer id billbarker Low Product pom developer id jfclere Low Product pom developer id mturk Low Product pom developer id remm Low Product pom developer id yoavs Low Product pom developer name Bill Barker Low Product pom developer name Jean-Frederic Clere Low Product pom developer name Mladen Turk Low Product pom developer name Remy Maucherat Low Product pom developer name Yoav Shapira Low Product pom groupid commons-daemon Highest Product pom name Commons Daemon High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/daemon/ Medium Version file version 1.0.13 High Version Manifest Bundle-Version 1.0.13 High Version Manifest Implementation-Version 1.0.13 High Version pom parent-version 1.0.13 Low Version pom version 1.0.13 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Commons Database Connection Pooling License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-dbcp/commons-dbcp/1.4/commons-dbcp-1.4.jar
MD5: b004158fab904f37f5831860898b3cd9
SHA1: 30be73c965cc990b153a100aaaaafcf239f82d39
SHA256: a6e2d83551d0e5b59aa942359f3010d35e79365e6552ad3dbaa6776e4851e4f6
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-dbcp High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name dbcp Highest Vendor Manifest bundle-docurl http://commons.apache.org/dbcp/ Low Vendor Manifest bundle-symbolicname org.apache.commons.dbcp Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-dbcp Highest Vendor pom artifactid commons-dbcp Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email markt@apache.org Low Vendor pom developer email mpoeschl@marmot.at Low Vendor pom developer email yoavs@apache.org Low Vendor pom developer id craigmcc Medium Vendor pom developer id dirkv Medium Vendor pom developer id dweinr1 Medium Vendor pom developer id geirm Medium Vendor pom developer id jmcnally Medium Vendor pom developer id joehni Medium Vendor pom developer id markt Medium Vendor pom developer id morgand Medium Vendor pom developer id mpoeschl Medium Vendor pom developer id psteitz Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id yoavs Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name David Weinrich Medium Vendor pom developer name Dirk Verbeeck Medium Vendor pom developer name Geir Magnusson Medium Vendor pom developer name Jörg Schaible Medium Vendor pom developer name John McNally Medium Vendor pom developer name Mark Thomas Medium Vendor pom developer name Martin Poeschl Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Yoav Shapira Medium Vendor pom developer org Apache Software Foundation Medium Vendor pom developer org tucana.at Medium Vendor pom groupid commons-dbcp Highest Vendor pom name Commons DBCP High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/dbcp/ Highest Product file name commons-dbcp High Product jar package name apache Highest Product jar package name commons Highest Product jar package name dbcp Highest Product Manifest bundle-docurl http://commons.apache.org/dbcp/ Low Product Manifest Bundle-Name Commons DBCP Medium Product Manifest bundle-symbolicname org.apache.commons.dbcp Medium Product Manifest Implementation-Title Commons DBCP High Product Manifest specification-title Commons DBCP Medium Product pom artifactid commons-dbcp Highest Product pom developer email joerg.schaible@gmx.de Low Product pom developer email markt@apache.org Low Product pom developer email mpoeschl@marmot.at Low Product pom developer email yoavs@apache.org Low Product pom developer id craigmcc Low Product pom developer id dirkv Low Product pom developer id dweinr1 Low Product pom developer id geirm Low Product pom developer id jmcnally Low Product pom developer id joehni Low Product pom developer id markt Low Product pom developer id morgand Low Product pom developer id mpoeschl Low Product pom developer id psteitz Low Product pom developer id rwaldhoff Low Product pom developer id yoavs Low Product pom developer name Craig McClanahan Low Product pom developer name David Weinrich Low Product pom developer name Dirk Verbeeck Low Product pom developer name Geir Magnusson Low Product pom developer name Jörg Schaible Low Product pom developer name John McNally Low Product pom developer name Mark Thomas Low Product pom developer name Martin Poeschl Low Product pom developer name Morgan Delagrange Low Product pom developer name Phil Steitz Low Product pom developer name Rodney Waldhoff Low Product pom developer name Yoav Shapira Low Product pom developer org Apache Software Foundation Low Product pom developer org tucana.at Low Product pom groupid commons-dbcp Highest Product pom name Commons DBCP High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/dbcp/ Medium Version file version 1.4 High Version Manifest Bundle-Version 1.4 High Version Manifest Implementation-Version 1.4 High Version pom parent-version 1.4 Low Version pom version 1.4 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The Digester package lets you configure an XML->Java object mapping module
which triggers certain actions called rules whenever a particular
pattern of nested XML elements is recognized. License:
The Apache Software License, Version 2.0: /LICENSE.txt File Path: /root/.m2/repository/commons-digester/commons-digester/1.8/commons-digester-1.8.jar
MD5: cf89c593f0378e9509a06fce7030aeba
SHA1: dc6a73fdbd1fa3f0944e8497c6c872fa21dca37e
SHA256: 05662373044f3dff112567b7bb5dfa1174e91e074c0c727b4412788013f49d56
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-digester High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name digester Highest Vendor jar package name rules Highest Vendor Manifest extension-name commons-digester Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-digester Highest Vendor pom artifactid commons-digester Low Vendor pom developer email craigmcc@apache.org Low Vendor pom developer email jfarcand@apache.org Low Vendor pom developer email jstrachan@apache.org Low Vendor pom developer email jvanzyl@apache.org Low Vendor pom developer email rahul AT apache DOT org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email sanders@totalsync.com Low Vendor pom developer email skitching@apache.org Low Vendor pom developer email tobrien@apache.org Low Vendor pom developer id craigmcc Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jstrachan Medium Vendor pom developer id jvanzyl Medium Vendor pom developer id rahul Medium Vendor pom developer id rdonkin Medium Vendor pom developer id sanders Medium Vendor pom developer id skitching Medium Vendor pom developer id tobrien Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name James Strachan Medium Vendor pom developer name Jason van Zyl Medium Vendor pom developer name Jean-Francois Arcand Medium Vendor pom developer name Rahul Akolkar Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Simon Kitching Medium Vendor pom developer name Tim OBrien Medium Vendor pom developer org Sun Microsystems Medium Vendor pom groupid commons-digester Highest Vendor pom name Digester High Vendor pom organization name The Apache Software Foundation High Vendor pom organization url http://jakarta.apache.org Medium Vendor pom url http://jakarta.apache.org/commons/digester/ Highest Product file name commons-digester High Product jar package name apache Highest Product jar package name commons Highest Product jar package name digester Highest Product jar package name rule Highest Product jar package name rules Highest Product Manifest extension-name commons-digester Medium Product Manifest Implementation-Title org.apache.commons.digester High Product Manifest specification-title Rule based XML->Java object mapping module Medium Product pom artifactid commons-digester Highest Product pom developer email craigmcc@apache.org Low Product pom developer email jfarcand@apache.org Low Product pom developer email jstrachan@apache.org Low Product pom developer email jvanzyl@apache.org Low Product pom developer email rahul AT apache DOT org Low Product pom developer email rdonkin@apache.org Low Product pom developer email sanders@totalsync.com Low Product pom developer email skitching@apache.org Low Product pom developer email tobrien@apache.org Low Product pom developer id craigmcc Low Product pom developer id jfarcand Low Product pom developer id jstrachan Low Product pom developer id jvanzyl Low Product pom developer id rahul Low Product pom developer id rdonkin Low Product pom developer id sanders Low Product pom developer id skitching Low Product pom developer id tobrien Low Product pom developer name Craig McClanahan Low Product pom developer name James Strachan Low Product pom developer name Jason van Zyl Low Product pom developer name Jean-Francois Arcand Low Product pom developer name Rahul Akolkar Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Scott Sanders Low Product pom developer name Simon Kitching Low Product pom developer name Tim OBrien Low Product pom developer org Sun Microsystems Low Product pom groupid commons-digester Highest Product pom name Digester High Product pom organization name The Apache Software Foundation Low Product pom organization url http://jakarta.apache.org Low Product pom url http://jakarta.apache.org/commons/digester/ Medium Version file version 1.8 High Version Manifest Implementation-Version 1.8 High Version pom version 1.8 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily. License:
Apache License: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar
MD5: 8ad8c9229ef2d59ab9f59f7050e846a5
SHA1: 964cd74171f427720480efdec40a7c7f6e58426a
SHA256: dbd4953d013e10e7c1cc3701a3e6ccd8c950c892f08d804fabfac21705930443
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-httpclient High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name httpclient Highest Vendor jar package name methods Highest Vendor manifest: org/apache/commons/httpclient Implementation-Vendor Apache Software Foundation Medium Vendor pom artifactid commons-httpclient Highest Vendor pom artifactid commons-httpclient Low Vendor pom developer email adrian.sutton -at- ephox.com Low Vendor pom developer email dion -at- apache.org Low Vendor pom developer email jericho -at- apache.org Low Vendor pom developer email jsdever -at- apache.org Low Vendor pom developer email mbecke -at- apache.org Low Vendor pom developer email oglueck -at- apache.org Low Vendor pom developer email olegk -at- apache.org Low Vendor pom developer email rwaldhoff -at- apache Low Vendor pom developer email sullis -at- apache.org Low Vendor pom developer id adrian Medium Vendor pom developer id dion Medium Vendor pom developer id jericho Medium Vendor pom developer id jsdever Medium Vendor pom developer id mbecke Medium Vendor pom developer id oglueck Medium Vendor pom developer id olegk Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sullis Medium Vendor pom developer name Adrian Sutton Medium Vendor pom developer name dIon Gillard Medium Vendor pom developer name Jeff Dever Medium Vendor pom developer name Michael Becke Medium Vendor pom developer name Oleg Kalnichevski Medium Vendor pom developer name Ortwin Glueck Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Sean C. Sullivan Medium Vendor pom developer name Sung-Gu Medium Vendor pom developer org Britannica Medium Vendor pom developer org Independent consultant Medium Vendor pom developer org Intencha Medium Vendor pom developer org Multitask Consulting Medium Vendor pom groupid commons-httpclient Highest Vendor pom name HttpClient High Vendor pom organization name Apache Software Foundation High Vendor pom organization url http://jakarta.apache.org/ Medium Vendor pom url http://jakarta.apache.org/httpcomponents/httpclient-3.x/ Highest Product file name commons-httpclient High Product jar package name apache Highest Product jar package name commons Highest Product jar package name httpclient Highest Product jar package name methods Highest Product manifest: org/apache/commons/httpclient Implementation-Title org.apache.commons.httpclient Medium Product manifest: org/apache/commons/httpclient Specification-Title Jakarta Commons HttpClient Medium Product pom artifactid commons-httpclient Highest Product pom developer email adrian.sutton -at- ephox.com Low Product pom developer email dion -at- apache.org Low Product pom developer email jericho -at- apache.org Low Product pom developer email jsdever -at- apache.org Low Product pom developer email mbecke -at- apache.org Low Product pom developer email oglueck -at- apache.org Low Product pom developer email olegk -at- apache.org Low Product pom developer email rwaldhoff -at- apache Low Product pom developer email sullis -at- apache.org Low Product pom developer id adrian Low Product pom developer id dion Low Product pom developer id jericho Low Product pom developer id jsdever Low Product pom developer id mbecke Low Product pom developer id oglueck Low Product pom developer id olegk Low Product pom developer id rwaldhoff Low Product pom developer id sullis Low Product pom developer name Adrian Sutton Low Product pom developer name dIon Gillard Low Product pom developer name Jeff Dever Low Product pom developer name Michael Becke Low Product pom developer name Oleg Kalnichevski Low Product pom developer name Ortwin Glueck Low Product pom developer name Rodney Waldhoff Low Product pom developer name Sean C. Sullivan Low Product pom developer name Sung-Gu Low Product pom developer org Britannica Low Product pom developer org Independent consultant Low Product pom developer org Intencha Low Product pom developer org Multitask Consulting Low Product pom groupid commons-httpclient Highest Product pom name HttpClient High Product pom organization name Apache Software Foundation Low Product pom organization url http://jakarta.apache.org/ Low Product pom url http://jakarta.apache.org/httpcomponents/httpclient-3.x/ Medium Version file version 3.1 High Version manifest: org/apache/commons/httpclient Implementation-Version 3.1 Medium Version pom version 3.1 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2012-5783 suppress
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (5.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N References:
Vulnerable Software & Versions:
CVE-2020-13956 suppress
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
The Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar
MD5: 7f97854dc04c119d461fed14f5d8bb96
SHA1: b1b6ea3b7e4aa4f492509a4952029cd8e48019ad
SHA256: cc6a41dc3eaacc9e440a6bd0d2890b20d36b4ee408fe2d67122f328bb6e01581
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-io High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name io Highest Vendor Manifest bundle-docurl http://commons.apache.org/io/ Low Vendor Manifest bundle-symbolicname org.apache.commons.io Medium Vendor Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-io Highest Vendor pom artifactid commons-io Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email dion@apache.org Low Vendor pom developer email ggregory@apache.org Low Vendor pom developer email jeremias@apache.org Low Vendor pom developer email jochen.wiedmann@gmail.com Low Vendor pom developer email martinc@apache.org Low Vendor pom developer email matth@apache.org Low Vendor pom developer email nicolaken@apache.org Low Vendor pom developer email roxspring@apache.org Low Vendor pom developer email sanders@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id dion Medium Vendor pom developer id ggregory Medium Vendor pom developer id jeremias Medium Vendor pom developer id jochen Medium Vendor pom developer id jukka Medium Vendor pom developer id martinc Medium Vendor pom developer id matth Medium Vendor pom developer id niallp Medium Vendor pom developer id nicolaken Medium Vendor pom developer id roxspring Medium Vendor pom developer id sanders Medium Vendor pom developer id scolebourne Medium Vendor pom developer name dIon Gillard Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name Jeremias Maerki Medium Vendor pom developer name Jochen Wiedmann Medium Vendor pom developer name Jukka Zitting Medium Vendor pom developer name Martin Cooper Medium Vendor pom developer name Matthew Hawthorne Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Nicola Ken Barozzi Medium Vendor pom developer name Rob Oxspring Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom groupid commons-io Highest Vendor pom name Commons IO High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/io/ Highest Product file name commons-io High Product jar package name apache Highest Product jar package name commons Highest Product jar package name io Highest Product Manifest bundle-docurl http://commons.apache.org/io/ Low Product Manifest Bundle-Name Commons IO Medium Product Manifest bundle-symbolicname org.apache.commons.io Medium Product Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low Product Manifest Implementation-Title Commons IO High Product Manifest specification-title Commons IO Medium Product pom artifactid commons-io Highest Product pom developer email bayard@apache.org Low Product pom developer email dion@apache.org Low Product pom developer email ggregory@apache.org Low Product pom developer email jeremias@apache.org Low Product pom developer email jochen.wiedmann@gmail.com Low Product pom developer email martinc@apache.org Low Product pom developer email matth@apache.org Low Product pom developer email nicolaken@apache.org Low Product pom developer email roxspring@apache.org Low Product pom developer email sanders@apache.org Low Product pom developer id bayard Low Product pom developer id dion Low Product pom developer id ggregory Low Product pom developer id jeremias Low Product pom developer id jochen Low Product pom developer id jukka Low Product pom developer id martinc Low Product pom developer id matth Low Product pom developer id niallp Low Product pom developer id nicolaken Low Product pom developer id roxspring Low Product pom developer id sanders Low Product pom developer id scolebourne Low Product pom developer name dIon Gillard Low Product pom developer name Gary Gregory Low Product pom developer name Henri Yandell Low Product pom developer name Jeremias Maerki Low Product pom developer name Jochen Wiedmann Low Product pom developer name Jukka Zitting Low Product pom developer name Martin Cooper Low Product pom developer name Matthew Hawthorne Low Product pom developer name Niall Pemberton Low Product pom developer name Nicola Ken Barozzi Low Product pom developer name Rob Oxspring Low Product pom developer name Scott Sanders Low Product pom developer name Stephen Colebourne Low Product pom groupid commons-io Highest Product pom name Commons IO High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/io/ Medium Version file version 2.4 High Version Manifest Implementation-Version 2.4 High Version pom parent-version 2.4 Low Version pom version 2.4 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2021-29425 suppress
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (5.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.8) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-io/commons-io/2.5/commons-io-2.5.jar
MD5: e2d74794fba570ec2115fb9d5b05dc9b
SHA1: 2852e6e05fbb95076fc091f6d1780f1f8fe35e0f
SHA256: a10418348d234968600ccb1d988efcbbd08716e1d96936ccc1880e7d22513474
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name commons-io High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name io Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Vendor Manifest bundle-symbolicname org.apache.commons.io Medium Vendor Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Vendor Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-io Highest Vendor pom artifactid commons-io Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email dion@apache.org Low Vendor pom developer email ggregory@apache.org Low Vendor pom developer email jeremias@apache.org Low Vendor pom developer email jochen.wiedmann@gmail.com Low Vendor pom developer email krosenvold@apache.org Low Vendor pom developer email martinc@apache.org Low Vendor pom developer email matth@apache.org Low Vendor pom developer email nicolaken@apache.org Low Vendor pom developer email roxspring@apache.org Low Vendor pom developer email sanders@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id dion Medium Vendor pom developer id ggregory Medium Vendor pom developer id jeremias Medium Vendor pom developer id jochen Medium Vendor pom developer id jukka Medium Vendor pom developer id krosenvold Medium Vendor pom developer id martinc Medium Vendor pom developer id matth Medium Vendor pom developer id niallp Medium Vendor pom developer id nicolaken Medium Vendor pom developer id roxspring Medium Vendor pom developer id sanders Medium Vendor pom developer id scolebourne Medium Vendor pom developer name dIon Gillard Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name Jeremias Maerki Medium Vendor pom developer name Jochen Wiedmann Medium Vendor pom developer name Jukka Zitting Medium Vendor pom developer name Kristian Rosenvold Medium Vendor pom developer name Martin Cooper Medium Vendor pom developer name Matthew Hawthorne Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Nicola Ken Barozzi Medium Vendor pom developer name Rob Oxspring Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom groupid commons-io Highest Vendor pom name Apache Commons IO High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/proper/commons-io/ Highest Product file name commons-io High Product jar package name apache Highest Product jar package name commons Highest Product jar package name io Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Product Manifest Bundle-Name Apache Commons IO Medium Product Manifest bundle-symbolicname org.apache.commons.io Medium Product Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Product Manifest Implementation-Title Apache Commons IO High Product Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest specification-title Apache Commons IO Medium Product pom artifactid commons-io Highest Product pom developer email bayard@apache.org Low Product pom developer email dion@apache.org Low Product pom developer email ggregory@apache.org Low Product pom developer email jeremias@apache.org Low Product pom developer email jochen.wiedmann@gmail.com Low Product pom developer email krosenvold@apache.org Low Product pom developer email martinc@apache.org Low Product pom developer email matth@apache.org Low Product pom developer email nicolaken@apache.org Low Product pom developer email roxspring@apache.org Low Product pom developer email sanders@apache.org Low Product pom developer id bayard Low Product pom developer id dion Low Product pom developer id ggregory Low Product pom developer id jeremias Low Product pom developer id jochen Low Product pom developer id jukka Low Product pom developer id krosenvold Low Product pom developer id martinc Low Product pom developer id matth Low Product pom developer id niallp Low Product pom developer id nicolaken Low Product pom developer id roxspring Low Product pom developer id sanders Low Product pom developer id scolebourne Low Product pom developer name dIon Gillard Low Product pom developer name Gary Gregory Low Product pom developer name Henri Yandell Low Product pom developer name Jeremias Maerki Low Product pom developer name Jochen Wiedmann Low Product pom developer name Jukka Zitting Low Product pom developer name Kristian Rosenvold Low Product pom developer name Martin Cooper Low Product pom developer name Matthew Hawthorne Low Product pom developer name Niall Pemberton Low Product pom developer name Nicola Ken Barozzi Low Product pom developer name Rob Oxspring Low Product pom developer name Scott Sanders Low Product pom developer name Stephen Colebourne Low Product pom groupid commons-io Highest Product pom name Apache Commons IO High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/proper/commons-io/ Medium Version file version 2.5 High Version Manifest Implementation-Version 2.5 High Version pom parent-version 2.5 Low Version pom version 2.5 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2021-29425 suppress
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (5.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.8) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
SHA256: 50f11b09f877c294d56f24463f47d28f929cf5044f648661c0f0cfbae9a2f49c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-lang High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name lang Highest Vendor Manifest bundle-docurl http://commons.apache.org/lang/ Low Vendor Manifest bundle-symbolicname org.apache.commons.lang Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-lang Highest Vendor pom artifactid commons-lang Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ggregory@seagullsw.com Low Vendor pom developer email jcarman@apache.org Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email oheger@apache.org Low Vendor pom developer email pbenedict@apache.org Low Vendor pom developer email phil@steitz.com Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email scolebourne@joda.org Low Vendor pom developer email stevencaswell@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id dlr Medium Vendor pom developer id fredrik Medium Vendor pom developer id ggregory Medium Vendor pom developer id jcarman Medium Vendor pom developer id joehni Medium Vendor pom developer id mbenson Medium Vendor pom developer id niallp Medium Vendor pom developer id oheger Medium Vendor pom developer id pbenedict Medium Vendor pom developer id psteitz Medium Vendor pom developer id rdonkin Medium Vendor pom developer id scaswell Medium Vendor pom developer id scolebourne Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name Fredrik Westermarck Medium Vendor pom developer name Gary D. Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name James Carman Medium Vendor pom developer name Joerg Schaible Medium Vendor pom developer name Matt Benson Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Oliver Heger Medium Vendor pom developer name Paul Benedict Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom developer name Steven Caswell Medium Vendor pom developer org Carman Consulting, Inc. Medium Vendor pom developer org CollabNet, Inc. Medium Vendor pom developer org Seagull Software Medium Vendor pom developer org SITA ATS Ltd Medium Vendor pom groupid commons-lang Highest Vendor pom name Commons Lang High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/lang/ Highest Product file name commons-lang High Product jar package name apache Highest Product jar package name commons Highest Product jar package name lang Highest Product Manifest bundle-docurl http://commons.apache.org/lang/ Low Product Manifest Bundle-Name Commons Lang Medium Product Manifest bundle-symbolicname org.apache.commons.lang Medium Product Manifest Implementation-Title Commons Lang High Product Manifest specification-title Commons Lang Medium Product pom artifactid commons-lang Highest Product pom developer email bayard@apache.org Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ggregory@seagullsw.com Low Product pom developer email jcarman@apache.org Low Product pom developer email joerg.schaible@gmx.de Low Product pom developer email oheger@apache.org Low Product pom developer email pbenedict@apache.org Low Product pom developer email phil@steitz.com Low Product pom developer email rdonkin@apache.org Low Product pom developer email scolebourne@joda.org Low Product pom developer email stevencaswell@apache.org Low Product pom developer id bayard Low Product pom developer id dlr Low Product pom developer id fredrik Low Product pom developer id ggregory Low Product pom developer id jcarman Low Product pom developer id joehni Low Product pom developer id mbenson Low Product pom developer id niallp Low Product pom developer id oheger Low Product pom developer id pbenedict Low Product pom developer id psteitz Low Product pom developer id rdonkin Low Product pom developer id scaswell Low Product pom developer id scolebourne Low Product pom developer name Daniel Rall Low Product pom developer name Fredrik Westermarck Low Product pom developer name Gary D. Gregory Low Product pom developer name Henri Yandell Low Product pom developer name James Carman Low Product pom developer name Joerg Schaible Low Product pom developer name Matt Benson Low Product pom developer name Niall Pemberton Low Product pom developer name Oliver Heger Low Product pom developer name Paul Benedict Low Product pom developer name Phil Steitz Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Stephen Colebourne Low Product pom developer name Steven Caswell Low Product pom developer org Carman Consulting, Inc. Low Product pom developer org CollabNet, Inc. Low Product pom developer org Seagull Software Low Product pom developer org SITA ATS Ltd Low Product pom groupid commons-lang Highest Product pom name Commons Lang High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/lang/ Medium Version file version 2.6 High Version Manifest Bundle-Version 2.6 High Version Manifest Implementation-Version 2.6 High Version pom parent-version 2.6 Low Version pom version 2.6 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
SHA256: 8ac96fc686512d777fca85e144f196cd7cfe0c0aec23127229497d1a38ff651c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-integration-test:compile livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-lang3 High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name lang3 Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium Vendor Manifest implementation-build release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000 Low Vendor Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-lang3 Highest Vendor pom artifactid commons-lang3 Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email britter@apache.org Low Vendor pom developer email chtompki@apache.org Low Vendor pom developer email djones@apache.org Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ggregory@apache.org Low Vendor pom developer email jcarman@apache.org Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email lguibert@apache.org Low Vendor pom developer email oheger@apache.org Low Vendor pom developer email pbenedict@apache.org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email scolebourne@joda.org Low Vendor pom developer email stevencaswell@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id britter Medium Vendor pom developer id chtompki Medium Vendor pom developer id djones Medium Vendor pom developer id dlr Medium Vendor pom developer id fredrik Medium Vendor pom developer id ggregory Medium Vendor pom developer id jcarman Medium Vendor pom developer id joehni Medium Vendor pom developer id lguibert Medium Vendor pom developer id mbenson Medium Vendor pom developer id niallp Medium Vendor pom developer id oheger Medium Vendor pom developer id pbenedict Medium Vendor pom developer id rdonkin Medium Vendor pom developer id scaswell Medium Vendor pom developer id scolebourne Medium Vendor pom developer name Benedikt Ritter Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name Duncan Jones Medium Vendor pom developer name Fredrik Westermarck Medium Vendor pom developer name Gary D. Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name James Carman Medium Vendor pom developer name Joerg Schaible Medium Vendor pom developer name Loic Guibert Medium Vendor pom developer name Matt Benson Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Oliver Heger Medium Vendor pom developer name Paul Benedict Medium Vendor pom developer name Rob Tompkins Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom developer name Steven Caswell Medium Vendor pom developer org Carman Consulting, Inc. Medium Vendor pom developer org CollabNet, Inc. Medium Vendor pom developer org SITA ATS Ltd Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Lang High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-lang/ Highest Product file name commons-lang3 High Product jar package name apache Highest Product jar package name commons Highest Product jar package name lang3 Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Product Manifest Bundle-Name Apache Commons Lang Medium Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium Product Manifest implementation-build release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000 Low Product Manifest Implementation-Title Apache Commons Lang High Product Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest specification-title Apache Commons Lang Medium Product pom artifactid commons-lang3 Highest Product pom developer email bayard@apache.org Low Product pom developer email britter@apache.org Low Product pom developer email chtompki@apache.org Low Product pom developer email djones@apache.org Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ggregory@apache.org Low Product pom developer email jcarman@apache.org Low Product pom developer email joerg.schaible@gmx.de Low Product pom developer email lguibert@apache.org Low Product pom developer email oheger@apache.org Low Product pom developer email pbenedict@apache.org Low Product pom developer email rdonkin@apache.org Low Product pom developer email scolebourne@joda.org Low Product pom developer email stevencaswell@apache.org Low Product pom developer id bayard Low Product pom developer id britter Low Product pom developer id chtompki Low Product pom developer id djones Low Product pom developer id dlr Low Product pom developer id fredrik Low Product pom developer id ggregory Low Product pom developer id jcarman Low Product pom developer id joehni Low Product pom developer id lguibert Low Product pom developer id mbenson Low Product pom developer id niallp Low Product pom developer id oheger Low Product pom developer id pbenedict Low Product pom developer id rdonkin Low Product pom developer id scaswell Low Product pom developer id scolebourne Low Product pom developer name Benedikt Ritter Low Product pom developer name Daniel Rall Low Product pom developer name Duncan Jones Low Product pom developer name Fredrik Westermarck Low Product pom developer name Gary D. Gregory Low Product pom developer name Henri Yandell Low Product pom developer name James Carman Low Product pom developer name Joerg Schaible Low Product pom developer name Loic Guibert Low Product pom developer name Matt Benson Low Product pom developer name Niall Pemberton Low Product pom developer name Oliver Heger Low Product pom developer name Paul Benedict Low Product pom developer name Rob Tompkins Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Stephen Colebourne Low Product pom developer name Steven Caswell Low Product pom developer org Carman Consulting, Inc. Low Product pom developer org CollabNet, Inc. Low Product pom developer org SITA ATS Ltd Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Lang High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-lang/ Medium Version file version 3.5 High Version Manifest Implementation-Version 3.5 High Version pom parent-version 3.5 Low Version pom version 3.5 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-lang3/3.6/commons-lang3-3.6.jar
MD5: 5d18f68b5122fd398c118df53ab4cf55
SHA1: 9d28a6b23650e8a7e9063c04588ace6cf7012c17
SHA256: 89c27f03fff18d0b06e7afd7ef25e209766df95b6c1269d6c3ebbdea48d5f284
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name commons-lang3 High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name lang3 Highest Vendor Manifest automatic-module-name org.apache.commons.lang3 Medium Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium Vendor Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.commons Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-lang3 Highest Vendor pom artifactid commons-lang3 Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email britter@apache.org Low Vendor pom developer email chtompki@apache.org Low Vendor pom developer email djones@apache.org Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ggregory@apache.org Low Vendor pom developer email jcarman@apache.org Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email lguibert@apache.org Low Vendor pom developer email oheger@apache.org Low Vendor pom developer email pbenedict@apache.org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email scolebourne@joda.org Low Vendor pom developer email stevencaswell@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id britter Medium Vendor pom developer id chtompki Medium Vendor pom developer id djones Medium Vendor pom developer id dlr Medium Vendor pom developer id fredrik Medium Vendor pom developer id ggregory Medium Vendor pom developer id jcarman Medium Vendor pom developer id joehni Medium Vendor pom developer id lguibert Medium Vendor pom developer id mbenson Medium Vendor pom developer id niallp Medium Vendor pom developer id oheger Medium Vendor pom developer id pbenedict Medium Vendor pom developer id rdonkin Medium Vendor pom developer id scaswell Medium Vendor pom developer id scolebourne Medium Vendor pom developer name Benedikt Ritter Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name Duncan Jones Medium Vendor pom developer name Fredrik Westermarck Medium Vendor pom developer name Gary D. Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name James Carman Medium Vendor pom developer name Joerg Schaible Medium Vendor pom developer name Loic Guibert Medium Vendor pom developer name Matt Benson Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Oliver Heger Medium Vendor pom developer name Paul Benedict Medium Vendor pom developer name Rob Tompkins Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom developer name Steven Caswell Medium Vendor pom developer org Carman Consulting, Inc. Medium Vendor pom developer org CollabNet, Inc. Medium Vendor pom developer org SITA ATS Ltd Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Lang High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-lang/ Highest Product file name commons-lang3 High Product jar package name apache Highest Product jar package name commons Highest Product jar package name lang3 Highest Product Manifest automatic-module-name org.apache.commons.lang3 Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Product Manifest Bundle-Name Apache Commons Lang Medium Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium Product Manifest Implementation-Title Apache Commons Lang High Product Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title Apache Commons Lang Medium Product pom artifactid commons-lang3 Highest Product pom developer email bayard@apache.org Low Product pom developer email britter@apache.org Low Product pom developer email chtompki@apache.org Low Product pom developer email djones@apache.org Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ggregory@apache.org Low Product pom developer email jcarman@apache.org Low Product pom developer email joerg.schaible@gmx.de Low Product pom developer email lguibert@apache.org Low Product pom developer email oheger@apache.org Low Product pom developer email pbenedict@apache.org Low Product pom developer email rdonkin@apache.org Low Product pom developer email scolebourne@joda.org Low Product pom developer email stevencaswell@apache.org Low Product pom developer id bayard Low Product pom developer id britter Low Product pom developer id chtompki Low Product pom developer id djones Low Product pom developer id dlr Low Product pom developer id fredrik Low Product pom developer id ggregory Low Product pom developer id jcarman Low Product pom developer id joehni Low Product pom developer id lguibert Low Product pom developer id mbenson Low Product pom developer id niallp Low Product pom developer id oheger Low Product pom developer id pbenedict Low Product pom developer id rdonkin Low Product pom developer id scaswell Low Product pom developer id scolebourne Low Product pom developer name Benedikt Ritter Low Product pom developer name Daniel Rall Low Product pom developer name Duncan Jones Low Product pom developer name Fredrik Westermarck Low Product pom developer name Gary D. Gregory Low Product pom developer name Henri Yandell Low Product pom developer name James Carman Low Product pom developer name Joerg Schaible Low Product pom developer name Loic Guibert Low Product pom developer name Matt Benson Low Product pom developer name Niall Pemberton Low Product pom developer name Oliver Heger Low Product pom developer name Paul Benedict Low Product pom developer name Rob Tompkins Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Stephen Colebourne Low Product pom developer name Steven Caswell Low Product pom developer org Carman Consulting, Inc. Low Product pom developer org CollabNet, Inc. Low Product pom developer org SITA ATS Ltd Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Lang High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-lang/ Medium Version file version 3.6 High Version Manifest Implementation-Version 3.6 High Version pom parent-version 3.6 Low Version pom version 3.6 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
MD5: 92eb5aabc1b47287de53d45c086a435c
SHA1: f6f66e966c70a83ffbdb6f17a0919eaf7c8aca7f
SHA256: 70903f6fc82e9908c8da9f20443f61d90f0870a312642991fe8462a0b9391784
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-integration-test:compile livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-logging High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name logging Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Vendor Manifest bundle-symbolicname org.apache.commons.logging Medium Vendor Manifest implementation-build tags/LOGGING_1_1_3_RC2@r1483540; 2013-05-16 22:04:41+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-logging Highest Vendor pom artifactid commons-logging Low Vendor pom developer email baliuka@apache.org Low Vendor pom developer email costin@apache.org Low Vendor pom developer email craigmcc@apache.org Low Vendor pom developer email dennisl@apache.org Low Vendor pom developer email donaldp@apache.org Low Vendor pom developer email morgand@apache.org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email rsitze@apache.org Low Vendor pom developer email rwaldhoff@apache.org Low Vendor pom developer email sanders@apache.org Low Vendor pom developer email skitching@apache.org Low Vendor pom developer email tn@apache.org Low Vendor pom developer id baliuka Medium Vendor pom developer id bstansberry Medium Vendor pom developer id costin Medium Vendor pom developer id craigmcc Medium Vendor pom developer id dennisl Medium Vendor pom developer id donaldp Medium Vendor pom developer id morgand Medium Vendor pom developer id rdonkin Medium Vendor pom developer id rsitze Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sanders Medium Vendor pom developer id skitching Medium Vendor pom developer id tn Medium Vendor pom developer name Brian Stansberry Medium Vendor pom developer name Costin Manolache Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name Dennis Lundberg Medium Vendor pom developer name Juozas Baliuka Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Peter Donald Medium Vendor pom developer name Richard Sitze Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Simon Kitching Medium Vendor pom developer name Thomas Neidhart Medium Vendor pom developer org Apache Medium Vendor pom developer org The Apache Software Foundation Medium Vendor pom groupid commons-logging Highest Vendor pom name Commons Logging High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/proper/commons-logging/ Highest Product file name commons-logging High Product jar package name apache Highest Product jar package name commons Highest Product jar package name logging Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Product Manifest Bundle-Name Commons Logging Medium Product Manifest bundle-symbolicname org.apache.commons.logging Medium Product Manifest implementation-build tags/LOGGING_1_1_3_RC2@r1483540; 2013-05-16 22:04:41+0200 Low Product Manifest Implementation-Title Commons Logging High Product Manifest specification-title Commons Logging Medium Product pom artifactid commons-logging Highest Product pom developer email baliuka@apache.org Low Product pom developer email costin@apache.org Low Product pom developer email craigmcc@apache.org Low Product pom developer email dennisl@apache.org Low Product pom developer email donaldp@apache.org Low Product pom developer email morgand@apache.org Low Product pom developer email rdonkin@apache.org Low Product pom developer email rsitze@apache.org Low Product pom developer email rwaldhoff@apache.org Low Product pom developer email sanders@apache.org Low Product pom developer email skitching@apache.org Low Product pom developer email tn@apache.org Low Product pom developer id baliuka Low Product pom developer id bstansberry Low Product pom developer id costin Low Product pom developer id craigmcc Low Product pom developer id dennisl Low Product pom developer id donaldp Low Product pom developer id morgand Low Product pom developer id rdonkin Low Product pom developer id rsitze Low Product pom developer id rwaldhoff Low Product pom developer id sanders Low Product pom developer id skitching Low Product pom developer id tn Low Product pom developer name Brian Stansberry Low Product pom developer name Costin Manolache Low Product pom developer name Craig McClanahan Low Product pom developer name Dennis Lundberg Low Product pom developer name Juozas Baliuka Low Product pom developer name Morgan Delagrange Low Product pom developer name Peter Donald Low Product pom developer name Richard Sitze Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Rodney Waldhoff Low Product pom developer name Scott Sanders Low Product pom developer name Simon Kitching Low Product pom developer name Thomas Neidhart Low Product pom developer org Apache Low Product pom developer org The Apache Software Foundation Low Product pom groupid commons-logging Highest Product pom name Commons Logging High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/proper/commons-logging/ Medium Version file version 1.1.3 High Version Manifest Bundle-Version 1.1.3 High Version Manifest Implementation-Version 1.1.3 High Version pom parent-version 1.1.3 Low Version pom version 1.1.3 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Apache Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA256: daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name commons-logging High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name logging Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Vendor Manifest bundle-symbolicname org.apache.commons.logging Medium Vendor Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-logging Highest Vendor pom artifactid commons-logging Low Vendor pom developer email baliuka@apache.org Low Vendor pom developer email costin@apache.org Low Vendor pom developer email craigmcc@apache.org Low Vendor pom developer email dennisl@apache.org Low Vendor pom developer email donaldp@apache.org Low Vendor pom developer email morgand@apache.org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email rsitze@apache.org Low Vendor pom developer email rwaldhoff@apache.org Low Vendor pom developer email sanders@apache.org Low Vendor pom developer email skitching@apache.org Low Vendor pom developer email tn@apache.org Low Vendor pom developer id baliuka Medium Vendor pom developer id bstansberry Medium Vendor pom developer id costin Medium Vendor pom developer id craigmcc Medium Vendor pom developer id dennisl Medium Vendor pom developer id donaldp Medium Vendor pom developer id morgand Medium Vendor pom developer id rdonkin Medium Vendor pom developer id rsitze Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sanders Medium Vendor pom developer id skitching Medium Vendor pom developer id tn Medium Vendor pom developer name Brian Stansberry Medium Vendor pom developer name Costin Manolache Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name Dennis Lundberg Medium Vendor pom developer name Juozas Baliuka Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Peter Donald Medium Vendor pom developer name Richard Sitze Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Simon Kitching Medium Vendor pom developer name Thomas Neidhart Medium Vendor pom developer org Apache Medium Vendor pom developer org The Apache Software Foundation Medium Vendor pom groupid commons-logging Highest Vendor pom name Apache Commons Logging High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/proper/commons-logging/ Highest Product file name commons-logging High Product jar package name apache Highest Product jar package name commons Highest Product jar package name logging Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Product Manifest Bundle-Name Apache Commons Logging Medium Product Manifest bundle-symbolicname org.apache.commons.logging Medium Product Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Product Manifest Implementation-Title Apache Commons Logging High Product Manifest specification-title Apache Commons Logging Medium Product pom artifactid commons-logging Highest Product pom developer email baliuka@apache.org Low Product pom developer email costin@apache.org Low Product pom developer email craigmcc@apache.org Low Product pom developer email dennisl@apache.org Low Product pom developer email donaldp@apache.org Low Product pom developer email morgand@apache.org Low Product pom developer email rdonkin@apache.org Low Product pom developer email rsitze@apache.org Low Product pom developer email rwaldhoff@apache.org Low Product pom developer email sanders@apache.org Low Product pom developer email skitching@apache.org Low Product pom developer email tn@apache.org Low Product pom developer id baliuka Low Product pom developer id bstansberry Low Product pom developer id costin Low Product pom developer id craigmcc Low Product pom developer id dennisl Low Product pom developer id donaldp Low Product pom developer id morgand Low Product pom developer id rdonkin Low Product pom developer id rsitze Low Product pom developer id rwaldhoff Low Product pom developer id sanders Low Product pom developer id skitching Low Product pom developer id tn Low Product pom developer name Brian Stansberry Low Product pom developer name Costin Manolache Low Product pom developer name Craig McClanahan Low Product pom developer name Dennis Lundberg Low Product pom developer name Juozas Baliuka Low Product pom developer name Morgan Delagrange Low Product pom developer name Peter Donald Low Product pom developer name Richard Sitze Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Rodney Waldhoff Low Product pom developer name Scott Sanders Low Product pom developer name Simon Kitching Low Product pom developer name Thomas Neidhart Low Product pom developer org Apache Low Product pom developer org The Apache Software Foundation Low Product pom groupid commons-logging Highest Product pom name Apache Commons Logging High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/proper/commons-logging/ Medium Version file version 1.2 High Version Manifest Implementation-Version 1.2 High Version pom parent-version 1.2 Low Version pom version 1.2 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The Math project is a library of lightweight, self-contained mathematics and statistics components addressing the most common practical problems not immediately available in the Java programming language or commons-lang. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-math3/3.1.1/commons-math3-3.1.1.jar
MD5: 505ece0d2261b037101e6c4bdf541ca7
SHA1: 6719d757a98ff24a83d9d727bef9cec83f59b6e1
SHA256: a07e39d31c46032879f0a48ae1bd0142b17dd67664c008b50216e9891f346c54
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name commons-math3 High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name math3 Highest Vendor Manifest bundle-docurl http://commons.apache.org/math/ Low Vendor Manifest bundle-symbolicname org.apache.commons.math3 Medium Vendor Manifest implementation-build tags/MATH_3_1_1_RC1@r1430928; 2013-01-09 17:13:33+0100 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-math3 Highest Vendor pom artifactid commons-math3 Low Vendor pom developer email achou at apache dot org Low Vendor pom developer email billbarker at apache dot org Low Vendor pom developer email brentworden at apache dot org Low Vendor pom developer email celestin at apache dot org Low Vendor pom developer email dimpbx at apache dot org Low Vendor pom developer email erans at apache dot org Low Vendor pom developer email gregs at apache dot org Low Vendor pom developer email j3322ptm at yahoo dot de Low Vendor pom developer email luc at apache dot org Low Vendor pom developer email mdiggory at apache dot org Low Vendor pom developer email mikl at apache dot org Low Vendor pom developer email psteitz at apache dot org Low Vendor pom developer email rdonkin at apache dot org Low Vendor pom developer email tn at apache dot org Low Vendor pom developer email tobrien at apache dot org Low Vendor pom developer id achou Medium Vendor pom developer id billbarker Medium Vendor pom developer id brentworden Medium Vendor pom developer id celestin Medium Vendor pom developer id dimpbx Medium Vendor pom developer id erans Medium Vendor pom developer id gregs Medium Vendor pom developer id luc Medium Vendor pom developer id mdiggory Medium Vendor pom developer id mikl Medium Vendor pom developer id pietsch Medium Vendor pom developer id psteitz Medium Vendor pom developer id rdonkin Medium Vendor pom developer id tn Medium Vendor pom developer id tobrien Medium Vendor pom developer name Albert Davidson Chou Medium Vendor pom developer name Bill Barker Medium Vendor pom developer name Brent Worden Medium Vendor pom developer name Dimitri Pourbaix Medium Vendor pom developer name Gilles Sadowski Medium Vendor pom developer name Greg Sterijevski Medium Vendor pom developer name J. Pietschmann Medium Vendor pom developer name Luc Maisonobe Medium Vendor pom developer name Mark Diggory Medium Vendor pom developer name Mikkel Meyer Andersen Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Sébastien Brisard Medium Vendor pom developer name Thomas Neidhart Medium Vendor pom developer name Tim O'Brien Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Commons Math High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/math/ Highest Product file name commons-math3 High Product jar package name apache Highest Product jar package name commons Highest Product jar package name math3 Highest Product Manifest bundle-docurl http://commons.apache.org/math/ Low Product Manifest Bundle-Name Commons Math Medium Product Manifest bundle-symbolicname org.apache.commons.math3 Medium Product Manifest implementation-build tags/MATH_3_1_1_RC1@r1430928; 2013-01-09 17:13:33+0100 Low Product Manifest Implementation-Title Commons Math High Product Manifest specification-title Commons Math Medium Product pom artifactid commons-math3 Highest Product pom developer email achou at apache dot org Low Product pom developer email billbarker at apache dot org Low Product pom developer email brentworden at apache dot org Low Product pom developer email celestin at apache dot org Low Product pom developer email dimpbx at apache dot org Low Product pom developer email erans at apache dot org Low Product pom developer email gregs at apache dot org Low Product pom developer email j3322ptm at yahoo dot de Low Product pom developer email luc at apache dot org Low Product pom developer email mdiggory at apache dot org Low Product pom developer email mikl at apache dot org Low Product pom developer email psteitz at apache dot org Low Product pom developer email rdonkin at apache dot org Low Product pom developer email tn at apache dot org Low Product pom developer email tobrien at apache dot org Low Product pom developer id achou Low Product pom developer id billbarker Low Product pom developer id brentworden Low Product pom developer id celestin Low Product pom developer id dimpbx Low Product pom developer id erans Low Product pom developer id gregs Low Product pom developer id luc Low Product pom developer id mdiggory Low Product pom developer id mikl Low Product pom developer id pietsch Low Product pom developer id psteitz Low Product pom developer id rdonkin Low Product pom developer id tn Low Product pom developer id tobrien Low Product pom developer name Albert Davidson Chou Low Product pom developer name Bill Barker Low Product pom developer name Brent Worden Low Product pom developer name Dimitri Pourbaix Low Product pom developer name Gilles Sadowski Low Product pom developer name Greg Sterijevski Low Product pom developer name J. Pietschmann Low Product pom developer name Luc Maisonobe Low Product pom developer name Mark Diggory Low Product pom developer name Mikkel Meyer Andersen Low Product pom developer name Phil Steitz Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Sébastien Brisard Low Product pom developer name Thomas Neidhart Low Product pom developer name Tim O'Brien Low Product pom groupid org.apache.commons Highest Product pom name Commons Math High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/math/ Medium Version file version 3.1.1 High Version Manifest Bundle-Version 3.1.1 High Version Manifest Implementation-Version 3.1.1 High Version pom parent-version 3.1.1 Low Version pom version 3.1.1 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
The Apache Commons Math project is a library of lightweight, self-contained mathematics and statistics components addressing the most common practical problems not immediately available in the Java programming language or commons-lang. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/commons/commons-math3/3.4.1/commons-math3-3.4.1.jar
MD5: 14a218d0ee57907dd2c7ef944b6c0afd
SHA1: 3ac44a8664228384bc68437264cf7c4cf112f579
SHA256: d1075b14a71087038b0bfd198f0f7dd8e49b5b3529d8e2eba99e7d9eb8565e4b
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-math3 High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name math3 Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-math/ Low Vendor Manifest bundle-symbolicname org.apache.commons.math3 Medium Vendor Manifest implementation-build ef6e0f882819e7c5230aece1610297e67775cca2; 2015-01-08 18:19:01+0100 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-math3 Highest Vendor pom artifactid commons-math3 Low Vendor pom developer email achou at apache dot org Low Vendor pom developer email billbarker at apache dot org Low Vendor pom developer email brentworden at apache dot org Low Vendor pom developer email celestin at apache dot org Low Vendor pom developer email dimpbx at apache dot org Low Vendor pom developer email erans at apache dot org Low Vendor pom developer email evanward at apache dot org Low Vendor pom developer email gregs at apache dot org Low Vendor pom developer email j3322ptm at yahoo dot de Low Vendor pom developer email luc at apache dot org Low Vendor pom developer email mdiggory at apache dot org Low Vendor pom developer email mikl at apache dot org Low Vendor pom developer email psteitz at apache dot org Low Vendor pom developer email rdonkin at apache dot org Low Vendor pom developer email tn at apache dot org Low Vendor pom developer email tobrien at apache dot org Low Vendor pom developer id achou Medium Vendor pom developer id billbarker Medium Vendor pom developer id brentworden Medium Vendor pom developer id celestin Medium Vendor pom developer id dimpbx Medium Vendor pom developer id erans Medium Vendor pom developer id evanward Medium Vendor pom developer id gregs Medium Vendor pom developer id luc Medium Vendor pom developer id mdiggory Medium Vendor pom developer id mikl Medium Vendor pom developer id pietsch Medium Vendor pom developer id psteitz Medium Vendor pom developer id rdonkin Medium Vendor pom developer id tn Medium Vendor pom developer id tobrien Medium Vendor pom developer name Albert Davidson Chou Medium Vendor pom developer name Bill Barker Medium Vendor pom developer name Brent Worden Medium Vendor pom developer name Dimitri Pourbaix Medium Vendor pom developer name Evan Ward Medium Vendor pom developer name Gilles Sadowski Medium Vendor pom developer name Greg Sterijevski Medium Vendor pom developer name J. Pietschmann Medium Vendor pom developer name Luc Maisonobe Medium Vendor pom developer name Mark Diggory Medium Vendor pom developer name Mikkel Meyer Andersen Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Sébastien Brisard Medium Vendor pom developer name Thomas Neidhart Medium Vendor pom developer name Tim O'Brien Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Math High Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-math/ Highest Product file name commons-math3 High Product jar package name apache Highest Product jar package name commons Highest Product jar package name math3 Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-math/ Low Product Manifest Bundle-Name Apache Commons Math Medium Product Manifest bundle-symbolicname org.apache.commons.math3 Medium Product Manifest implementation-build ef6e0f882819e7c5230aece1610297e67775cca2; 2015-01-08 18:19:01+0100 Low Product Manifest Implementation-Title Apache Commons Math High Product Manifest specification-title Apache Commons Math Medium Product pom artifactid commons-math3 Highest Product pom developer email achou at apache dot org Low Product pom developer email billbarker at apache dot org Low Product pom developer email brentworden at apache dot org Low Product pom developer email celestin at apache dot org Low Product pom developer email dimpbx at apache dot org Low Product pom developer email erans at apache dot org Low Product pom developer email evanward at apache dot org Low Product pom developer email gregs at apache dot org Low Product pom developer email j3322ptm at yahoo dot de Low Product pom developer email luc at apache dot org Low Product pom developer email mdiggory at apache dot org Low Product pom developer email mikl at apache dot org Low Product pom developer email psteitz at apache dot org Low Product pom developer email rdonkin at apache dot org Low Product pom developer email tn at apache dot org Low Product pom developer email tobrien at apache dot org Low Product pom developer id achou Low Product pom developer id billbarker Low Product pom developer id brentworden Low Product pom developer id celestin Low Product pom developer id dimpbx Low Product pom developer id erans Low Product pom developer id evanward Low Product pom developer id gregs Low Product pom developer id luc Low Product pom developer id mdiggory Low Product pom developer id mikl Low Product pom developer id pietsch Low Product pom developer id psteitz Low Product pom developer id rdonkin Low Product pom developer id tn Low Product pom developer id tobrien Low Product pom developer name Albert Davidson Chou Low Product pom developer name Bill Barker Low Product pom developer name Brent Worden Low Product pom developer name Dimitri Pourbaix Low Product pom developer name Evan Ward Low Product pom developer name Gilles Sadowski Low Product pom developer name Greg Sterijevski Low Product pom developer name J. Pietschmann Low Product pom developer name Luc Maisonobe Low Product pom developer name Mark Diggory Low Product pom developer name Mikkel Meyer Andersen Low Product pom developer name Phil Steitz Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Sébastien Brisard Low Product pom developer name Thomas Neidhart Low Product pom developer name Tim O'Brien Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Math High Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-math/ Medium Version file version 3.4.1 High Version Manifest Bundle-Version 3.4.1 High Version Manifest Implementation-Version 3.4.1 High Version pom parent-version 3.4.1 Low Version pom version 3.4.1 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Apache Commons Net library contains a collection of network utilities and protocol implementations.
Supported protocols include: Echo, Finger, FTP, NNTP, NTP, POP3(S), SMTP(S), Telnet, Whois
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-net/commons-net/3.1/commons-net-3.1.jar
MD5: 23c94d51e72f341fb412d6a015e16313
SHA1: 2298164a7c2484406f2aa5ac85b205d39019896f
SHA256: 34a58d6d80a50748307e674ec27b4411e6536fd12e78bec428eb2ee49a123007
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name commons-net High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name echo Highest Vendor jar package name finger Highest Vendor jar package name ftp Highest Vendor jar package name net Highest Vendor jar package name nntp Highest Vendor jar package name pop3 Highest Vendor jar package name smtp Highest Vendor jar package name telnet Highest Vendor jar package name whois Highest Vendor Manifest bundle-docurl http://commons.apache.org/net/ Low Vendor Manifest bundle-symbolicname org.apache.commons.net Medium Vendor Manifest implementation-build tags/NET_3_1_RC2@r1244108; 2012-02-14 17:45:12+0000 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-net Highest Vendor pom artifactid commons-net Low Vendor pom developer email bruno.davanzo@hp.com Low Vendor pom developer email dfs@apache.org Low Vendor pom developer email Jeff.Brekke@qg.com Low Vendor pom developer email rwinston@apache.org Low Vendor pom developer email scohen@apache.org Low Vendor pom developer id brekke Medium Vendor pom developer id brudav Medium Vendor pom developer id dfs Medium Vendor pom developer id rwinston Medium Vendor pom developer id scohen Medium Vendor pom developer name Bruno D'Avanzo Medium Vendor pom developer name Daniel F. Savarese Medium Vendor pom developer name Jeffrey D. Brekke Medium Vendor pom developer name Rory Winston Medium Vendor pom developer name Steve Cohen Medium Vendor pom developer org
<a href="http://www.savarese.com/">Savarese Software Research</a>
Medium Vendor pom developer org Hewlett-Packard Medium Vendor pom developer org javactivity.org Medium Vendor pom developer org Quad/Graphics, Inc. Medium Vendor pom groupid commons-net Highest Vendor pom name Commons Net High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/net/ Highest Product file name commons-net High Product jar package name apache Highest Product jar package name commons Highest Product jar package name echo Highest Product jar package name finger Highest Product jar package name ftp Highest Product jar package name net Highest Product jar package name nntp Highest Product jar package name pop3 Highest Product jar package name smtp Highest Product jar package name telnet Highest Product jar package name whois Highest Product Manifest bundle-docurl http://commons.apache.org/net/ Low Product Manifest Bundle-Name Commons Net Medium Product Manifest bundle-symbolicname org.apache.commons.net Medium Product Manifest implementation-build tags/NET_3_1_RC2@r1244108; 2012-02-14 17:45:12+0000 Low Product Manifest Implementation-Title Commons Net High Product Manifest specification-title Commons Net Medium Product pom artifactid commons-net Highest Product pom developer email bruno.davanzo@hp.com Low Product pom developer email dfs@apache.org Low Product pom developer email Jeff.Brekke@qg.com Low Product pom developer email rwinston@apache.org Low Product pom developer email scohen@apache.org Low Product pom developer id brekke Low Product pom developer id brudav Low Product pom developer id dfs Low Product pom developer id rwinston Low Product pom developer id scohen Low Product pom developer name Bruno D'Avanzo Low Product pom developer name Daniel F. Savarese Low Product pom developer name Jeffrey D. Brekke Low Product pom developer name Rory Winston Low Product pom developer name Steve Cohen Low Product pom developer org
<a href="http://www.savarese.com/">Savarese Software Research</a>
Low Product pom developer org Hewlett-Packard Low Product pom developer org javactivity.org Low Product pom developer org Quad/Graphics, Inc. Low Product pom groupid commons-net Highest Product pom name Commons Net High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/net/ Medium Version file version 3.1 High Version Manifest Implementation-Version 3.1 High Version pom parent-version 3.1 Low Version pom version 3.1 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Commons Object Pooling Library License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/commons-pool/commons-pool/1.5.4/commons-pool-1.5.4.jar
MD5: 80e9d1cbd70542f4f293793d109679a9
SHA1: 75b6e20c596ed2945a259cea26d7fadd298398e6
SHA256: 22095672ac3ad6503e42ec6d4cbc330cd1318040223f6c5d9605473b6d2aa0fd
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name commons-pool High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name pool Highest Vendor Manifest bundle-docurl http://commons.apache.org/pool/ Low Vendor Manifest bundle-symbolicname org.apache.commons.pool Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-pool Highest Vendor pom artifactid commons-pool Low Vendor pom developer id craigmcc Medium Vendor pom developer id dirkv Medium Vendor pom developer id dweinr1 Medium Vendor pom developer id geirm Medium Vendor pom developer id morgand Medium Vendor pom developer id psteitz Medium Vendor pom developer id rdonkin Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sandymac Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name David Weinrich Medium Vendor pom developer name Dirk Verbeeck Medium Vendor pom developer name Geir Magnusson Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Phil Steitz Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Sandy McArthur Medium Vendor pom developer org Apache Software Foundation Medium Vendor pom groupid commons-pool Highest Vendor pom name Commons Pool High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/pool/ Highest Product file name commons-pool High Product jar package name apache Highest Product jar package name commons Highest Product jar package name pool Highest Product Manifest bundle-docurl http://commons.apache.org/pool/ Low Product Manifest Bundle-Name Commons Pool Medium Product Manifest bundle-symbolicname org.apache.commons.pool Medium Product Manifest Implementation-Title Commons Pool High Product Manifest specification-title Commons Pool Medium Product pom artifactid commons-pool Highest Product pom developer id craigmcc Low Product pom developer id dirkv Low Product pom developer id dweinr1 Low Product pom developer id geirm Low Product pom developer id morgand Low Product pom developer id psteitz Low Product pom developer id rdonkin Low Product pom developer id rwaldhoff Low Product pom developer id sandymac Low Product pom developer name Craig McClanahan Low Product pom developer name David Weinrich Low Product pom developer name Dirk Verbeeck Low Product pom developer name Geir Magnusson Low Product pom developer name Morgan Delagrange Low Product pom developer name Phil Steitz Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Rodney Waldhoff Low Product pom developer name Sandy McArthur Low Product pom developer org Apache Software Foundation Low Product pom groupid commons-pool Highest Product pom name Commons Pool High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/pool/ Medium Version file version 1.5.4 High Version Manifest Bundle-Version 1.5.4 High Version Manifest Implementation-Version 1.5.4 High Version pom parent-version 1.5.4 Low Version pom version 1.5.4 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Compression codec for LZF encoding for particularly encoding/decoding, with reasonable compression.
Compressor is basic Lempel-Ziv codec, without Huffman (deflate/gzip) or statistical post-encoding.
See "http://oldhome.schmorp.de/marc/liblzf.html" for more on original LZF package.
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/com/ning/compress-lzf/1.0.3/compress-lzf-1.0.3.jar
MD5: dc55ed6fe0bbad93bbf38331768ba1b4
SHA1: 3e1495b0c532ebe58f1c8b1c5d9b3bdcc6c1504c
SHA256: 6cf93bda1c2caf618652f97d2f36c883a5a9774345384c05d3593b173731bccd
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name compress-lzf High Vendor jar package name compress Highest Vendor jar package name gzip Highest Vendor jar package name lzf Highest Vendor jar package name ning Highest Vendor Manifest bundle-symbolicname com.ning.compress-lzf Medium Vendor pom artifactid compress-lzf Highest Vendor pom artifactid compress-lzf Low Vendor pom developer email tatu.saloranta@iki.fi Low Vendor pom developer id tatu Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid com.ning Highest Vendor pom name Compress-LZF High Vendor pom url http://github.com/ning/compress Highest Product file name compress-lzf High Product jar package name compress Highest Product jar package name gzip Highest Product jar package name lzf Highest Product jar package name ning Highest Product Manifest Bundle-Name Compress-LZF Medium Product Manifest bundle-symbolicname com.ning.compress-lzf Medium Product pom artifactid compress-lzf Highest Product pom developer email tatu.saloranta@iki.fi Low Product pom developer id tatu Low Product pom developer name Tatu Saloranta Low Product pom groupid com.ning Highest Product pom name Compress-LZF High Product pom url http://github.com/ning/compress Medium Version file version 1.0.3 High Version Manifest Bundle-Version 1.0.3 High Version pom version 1.0.3 Highest
File Path: /root/.m2/repository/com/github/fommil/netlib/core/1.1.2/core-1.1.2.jarMD5: ab845840ad73fa2ec1a5025a7c48b97eSHA1: 574b480eca62f535fad6d259e144fee3ef24b66eSHA256: 5ffaddee0a3f8d09a56064aa05feb95837ddad9d42d9dcc37479c66e869aa139Referenced In Projects/Scopes:
livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name core High Vendor jar package name fommil Highest Vendor jar package name fommil Low Vendor jar package name github Highest Vendor jar package name github Low Vendor jar package name netlib Highest Vendor jar package name netlib Low Vendor pom artifactid core Highest Vendor pom artifactid core Low Vendor pom groupid com.github.fommil.netlib Highest Vendor pom parent-artifactid parent Low Product file name core High Product jar package name fommil Highest Product jar package name fommil Low Product jar package name github Highest Product jar package name netlib Highest Product jar package name netlib Low Product pom artifactid core Highest Product pom groupid com.github.fommil.netlib Highest Product pom parent-artifactid parent Medium Version file version 1.1.2 High Version pom parent-version 1.1.2 Low Version pom version 1.1.2 Highest
Description:
Low-level API License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/curator/curator-client/2.7.1/curator-client-2.7.1.jar
MD5: 3b43933c18d1dcf15f88db73ee646396
SHA1: a591dfc085db3e9d4d480381cc7e6ae8a26b34af
SHA256: 949ac95323bb13b4d9cde33ab1ca73f07a87e6e43cf76629e89fdd74d5b378e4
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name curator-client High Vendor jar package name apache Highest Vendor jar package name curator Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname curator-client Medium Vendor pom artifactid curator-client Highest Vendor pom artifactid curator-client Low Vendor pom groupid org.apache.curator Highest Vendor pom name Curator Client High Vendor pom parent-artifactid apache-curator Low Product file name curator-client High Product jar package name apache Highest Product jar package name curator Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Curator Client Medium Product Manifest bundle-symbolicname curator-client Medium Product pom artifactid curator-client Highest Product pom groupid org.apache.curator Highest Product pom name Curator Client High Product pom parent-artifactid apache-curator Medium Version file version 2.7.1 High Version Manifest Bundle-Version 2.7.1 High Version pom version 2.7.1 Highest
Description:
High-level API that greatly simplifies using ZooKeeper. License:
file:///Users/cam/Documents/workspace/curator/target/checkout/curator-framework/LICENSE File Path: /root/.m2/repository/org/apache/curator/curator-framework/2.6.0/curator-framework-2.6.0.jar
MD5: 673657556b6616c318884e1b0ead0c0b
SHA1: 81a699c39d127b5b4ff97cc77da7650b53e5b5ed
SHA256: 3a76e2185663750b20713101f6b08cb941ec32851544c61d778262fd88b17735
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name curator-framework High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name curator Highest Vendor jar package name framework Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname curator-framework Medium Vendor pom artifactid curator-framework Highest Vendor pom artifactid curator-framework Low Vendor pom groupid org.apache.curator Highest Vendor pom name Curator Framework High Vendor pom parent-artifactid apache-curator Low Product file name curator-framework High Product jar package name apache Highest Product jar package name api Highest Product jar package name curator Highest Product jar package name framework Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Curator Framework Medium Product Manifest bundle-symbolicname curator-framework Medium Product pom artifactid curator-framework Highest Product pom groupid org.apache.curator Highest Product pom name Curator Framework High Product pom parent-artifactid apache-curator Medium Version file version 2.6.0 High Version Manifest Bundle-Version 2.6.0 High Version pom version 2.6.0 Highest
Description:
High-level API that greatly simplifies using ZooKeeper. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/curator/curator-framework/2.7.1/curator-framework-2.7.1.jar
MD5: 35bff30d2a79a8b0731269604b1327ee
SHA1: 8c7b1eeb78e43bb91ea737111ba3dec0512be876
SHA256: a65e3f515b022d84d86c553c99216e384bc82d1de51b5a32b10f33314ad81ceb
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name curator-framework High Vendor jar package name apache Highest Vendor jar package name api Highest Vendor jar package name curator Highest Vendor jar package name framework Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname curator-framework Medium Vendor pom artifactid curator-framework Highest Vendor pom artifactid curator-framework Low Vendor pom groupid org.apache.curator Highest Vendor pom name Curator Framework High Vendor pom parent-artifactid apache-curator Low Product file name curator-framework High Product jar package name apache Highest Product jar package name api Highest Product jar package name curator Highest Product jar package name framework Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Curator Framework Medium Product Manifest bundle-symbolicname curator-framework Medium Product pom artifactid curator-framework Highest Product pom groupid org.apache.curator Highest Product pom name Curator Framework High Product pom parent-artifactid apache-curator Medium Version file version 2.7.1 High Version Manifest Bundle-Version 2.7.1 High Version pom version 2.7.1 Highest
Description:
All of the recipes listed on the ZooKeeper recipes doc (except two phase commit). License:
file:///Users/cam/Documents/workspace/curator/target/checkout/curator-recipes/LICENSE File Path: /root/.m2/repository/org/apache/curator/curator-recipes/2.6.0/curator-recipes-2.6.0.jar
MD5: 8e70a808344647a65033b30690ea01ed
SHA1: 8736b0fc42e6bf006d585fe85c90aaa4ade5cbef
SHA256: cdf18d26a96276646d69cd82ac0d8dd5d437c4786b1dbbaae02b1eaf0aaa327e
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name curator-recipes High Vendor jar package name apache Highest Vendor jar package name curator Highest Vendor jar package name recipes Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname curator-recipes Medium Vendor pom artifactid curator-recipes Highest Vendor pom artifactid curator-recipes Low Vendor pom groupid org.apache.curator Highest Vendor pom name Curator Recipes High Vendor pom parent-artifactid apache-curator Low Product file name curator-recipes High Product jar package name apache Highest Product jar package name curator Highest Product jar package name recipes Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Curator Recipes Medium Product Manifest bundle-symbolicname curator-recipes Medium Product pom artifactid curator-recipes Highest Product pom groupid org.apache.curator Highest Product pom name Curator Recipes High Product pom parent-artifactid apache-curator Medium Version file version 2.6.0 High Version Manifest Bundle-Version 2.6.0 High Version pom version 2.6.0 Highest
Description:
All of the recipes listed on the ZooKeeper recipes doc (except two phase commit). License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/curator/curator-recipes/2.7.1/curator-recipes-2.7.1.jar
MD5: 156ad30fb9995b072175ae60fbb352a5
SHA1: a2c180efc6a38a4f8c9197eb35bb4eb5716cd2fa
SHA256: ce122f137e36268e30082bf1565c51d874ca926801be3ca73b3c0d522b0dfe2c
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name curator-recipes High Vendor jar package name apache Highest Vendor jar package name curator Highest Vendor jar package name recipes Highest Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor Manifest bundle-symbolicname curator-recipes Medium Vendor pom artifactid curator-recipes Highest Vendor pom artifactid curator-recipes Low Vendor pom groupid org.apache.curator Highest Vendor pom name Curator Recipes High Vendor pom parent-artifactid apache-curator Low Product file name curator-recipes High Product jar package name apache Highest Product jar package name curator Highest Product jar package name recipes Highest Product Manifest bundle-docurl http://www.apache.org/ Low Product Manifest Bundle-Name Curator Recipes Medium Product Manifest bundle-symbolicname curator-recipes Medium Product pom artifactid curator-recipes Highest Product pom groupid org.apache.curator Highest Product pom name Curator Recipes High Product pom parent-artifactid apache-curator Medium Version file version 2.7.1 High Version Manifest Bundle-Version 2.7.1 High Version pom version 2.7.1 Highest
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/dataTables.bootstrap.min.jsMD5: 19b11075f9b46a3cd26fb39a6f252b5dSHA1: 44074789abea496fc9402979617f7d815d5cc7a2SHA256: 5ffe7cb3959b946300c3d4a90edaa757c74b44d09ac2cc86c0daa7643d097bfbReferenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
Plugin providing DataNucleus implementation of the JDO API.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/datanucleus/datanucleus-api-jdo/3.2.6/datanucleus-api-jdo-3.2.6.jar
MD5: ee20159b2f4995090a3650d8e0ea7b2f
SHA1: cb21100ecc0d2e80dfd62067046c8a2a25a95c50
SHA256: 3780b008de45ea0599ec6e636f72694ff781028abc044fe5a49adf42d9560da2
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name datanucleus-api-jdo High Vendor jar package name api Highest Vendor jar package name datanucleus Highest Vendor jar package name jdo Highest Vendor Manifest bundle-symbolicname org.datanucleus.api.jdo;singleton:=true Medium Vendor Manifest require-bundle org.datanucleus;bundle-version="3.2.9" Low Vendor pom artifactid datanucleus-api-jdo Highest Vendor pom artifactid datanucleus-api-jdo Low Vendor pom developer id andy Medium Vendor pom developer name Andy Medium Vendor pom developer org DataNucleus Medium Vendor pom groupid org.datanucleus Highest Vendor pom name DataNucleus JDO API plugin High Vendor pom url http://www.datanucleus.org Highest Product file name datanucleus-api-jdo High Product jar package name api Highest Product jar package name datanucleus Highest Product jar package name jdo Highest Product Manifest Bundle-Name DataNucleus JDO API Medium Product Manifest bundle-symbolicname org.datanucleus.api.jdo;singleton:=true Medium Product Manifest require-bundle org.datanucleus;bundle-version="3.2.9" Low Product pom artifactid datanucleus-api-jdo Highest Product pom developer id andy Low Product pom developer name Andy Low Product pom developer org DataNucleus Low Product pom groupid org.datanucleus Highest Product pom name DataNucleus JDO API plugin High Product pom url http://www.datanucleus.org Medium Version file version 3.2.6 High Version Manifest Bundle-Version 3.2.6 High Version pom version 3.2.6 Highest
Description:
DataNucleus Core provides the primary components of a heterogenous Java persistence solution.
It supports persistence API's being layered on top of the core functionality.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/datanucleus/datanucleus-core/3.2.10/datanucleus-core-3.2.10.jar
MD5: 8ed6c39b31ea8cd355a791df3d0c4888
SHA1: 7ad66634f30d7c6a06373475e94bcfbe65e2648e
SHA256: 6125a714a581b7fe538fd73364d5ce977ff13fbe53d6a5ae996c0017f13b55ff
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name datanucleus-core High Vendor jar package name api Highest Vendor jar package name datanucleus Highest Vendor Manifest bundle-symbolicname org.datanucleus;singleton:=true Medium Vendor Manifest require-bundle org.eclipse.equinox.registry;resolution:=optional,org.eclipse.core.runtime;resolution:=optional Low Vendor pom artifactid datanucleus-core Highest Vendor pom artifactid datanucleus-core Low Vendor pom developer id andy Medium Vendor pom developer name Andy Medium Vendor pom developer org DataNucleus Medium Vendor pom groupid org.datanucleus Highest Vendor pom name DataNucleus Core High Vendor pom url http://www.datanucleus.org Highest Product file name datanucleus-core High Product jar package name api Highest Product jar package name datanucleus Highest Product Manifest Bundle-Name DataNucleus Core Medium Product Manifest bundle-symbolicname org.datanucleus;singleton:=true Medium Product Manifest require-bundle org.eclipse.equinox.registry;resolution:=optional,org.eclipse.core.runtime;resolution:=optional Low Product pom artifactid datanucleus-core Highest Product pom developer id andy Low Product pom developer name Andy Low Product pom developer org DataNucleus Low Product pom groupid org.datanucleus Highest Product pom name DataNucleus Core High Product pom url http://www.datanucleus.org Medium Version file version 3.2.10 High Version Manifest Bundle-Version 3.2.10 High Version pom version 3.2.10 Highest
CVE-2021-41033 suppress
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Plugin for DataNucleus providing persistence to RDBMS datastores.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/datanucleus/datanucleus-rdbms/3.2.9/datanucleus-rdbms-3.2.9.jar
MD5: 7d07a9eb98373433d47a441b0e70166c
SHA1: b95b6ff6ea969ab67f06754108167c4f9fadfd7e
SHA256: d4aadfaf95bb2550b0e8ebb0bb8095b27c9f0e36edc49e42b8215d0852e371a9
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name datanucleus-rdbms High Vendor jar package name datanucleus Highest Vendor jar package name rdbms Highest Vendor jar package name store Highest Vendor Manifest bundle-symbolicname org.datanucleus.store.rdbms;singleton:=true Medium Vendor Manifest require-bundle org.datanucleus;bundle-version="3.2.9" Low Vendor pom artifactid datanucleus-rdbms Highest Vendor pom artifactid datanucleus-rdbms Low Vendor pom developer id andy Medium Vendor pom developer name Andy Medium Vendor pom developer org DataNucleus Medium Vendor pom groupid org.datanucleus Highest Vendor pom name DataNucleus RDBMS High Vendor pom url http://www.datanucleus.org Highest Product file name datanucleus-rdbms High Product jar package name datanucleus Highest Product jar package name rdbms Highest Product jar package name store Highest Product Manifest Bundle-Name DataNucleus RDBMS Medium Product Manifest bundle-symbolicname org.datanucleus.store.rdbms;singleton:=true Medium Product Manifest require-bundle org.datanucleus;bundle-version="3.2.9" Low Product pom artifactid datanucleus-rdbms Highest Product pom developer id andy Low Product pom developer name Andy Low Product pom developer org DataNucleus Low Product pom groupid org.datanucleus Highest Product pom name DataNucleus RDBMS High Product pom url http://www.datanucleus.org Medium Version file version 3.2.9 High Version Manifest Bundle-Version 3.2.9 High Version pom version 3.2.9 Highest
Description:
Contains the core Apache Derby database engine, which also includes the embedded JDBC driver. File Path: /root/.m2/repository/org/apache/derby/derby/10.12.1.1/derby-10.12.1.1.jarMD5: 372f9924d8ce658d8def342783319885SHA1: 75070c744a8e52a7d17b8b476468580309d5cd09SHA256: 000a7e23220d0544d7034a9ccb313d0aa5d40074e724ba69c1bb713f765d4cfdReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name derby High Vendor jar package name apache Highest Vendor jar package name database Highest Vendor jar package name derby Highest Vendor jar package name jdbc Highest Vendor Manifest bundle-symbolicname derby Medium Vendor pom artifactid derby Highest Vendor pom artifactid derby Low Vendor pom groupid org.apache.derby Highest Vendor pom name Apache Derby Database Engine and Embedded JDBC Driver High Vendor pom parent-artifactid derby-project Low Product file name derby High Product jar package name apache Highest Product jar package name database Highest Product jar package name derby Highest Product jar package name jdbc Highest Product Manifest Bundle-Name Apache Derby 10.12 Medium Product Manifest bundle-symbolicname derby Medium Product pom artifactid derby Highest Product pom groupid org.apache.derby Highest Product pom name Apache Derby Database Engine and Embedded JDBC Driver High Product pom parent-artifactid derby-project Medium Version file version 10.12.1.1 High Version pom version 10.12.1.1 Highest
CVE-2018-1313 suppress
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work. NVD-CWE-noinfo
CVSSv2:
Base Score: LOW (3.5) Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Type-safe access to Java system properties License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/net/hydromatic/eigenbase-properties/1.1.5/eigenbase-properties-1.1.5.jar
MD5: 74250b1aa57ff13507bf28c09e5299eb
SHA1: a941956b3a4664d0cf728ece06ba25cc2110a3aa
SHA256: 9394a752411d9729a083cf578ed9666ec9a7f59c18c9ca889127480a44c7285c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name eigenbase-properties High Vendor jar package name eigenbase Highest Vendor Manifest bundle-docurl http://www.hydromatic.net Low Vendor Manifest bundle-symbolicname net.hydromatic.eigenbase-properties Medium Vendor pom artifactid eigenbase-properties Highest Vendor pom artifactid eigenbase-properties Low Vendor pom developer email jhyde@apache.org Low Vendor pom developer id julianhyde Medium Vendor pom developer name Julian Hyde Medium Vendor pom groupid net.hydromatic Highest Vendor pom name eigenbase-properties High Vendor pom organization name Julian Hyde High Vendor pom organization url http://www.hydromatic.net Medium Vendor pom parent-artifactid parent Low Vendor pom url http://github.com/julianhyde/eigenbase-properties Highest Product file name eigenbase-properties High Product jar package name eigenbase Highest Product Manifest bundle-docurl http://www.hydromatic.net Low Product Manifest Bundle-Name eigenbase-properties Medium Product Manifest bundle-symbolicname net.hydromatic.eigenbase-properties Medium Product pom artifactid eigenbase-properties Highest Product pom developer email jhyde@apache.org Low Product pom developer id julianhyde Low Product pom developer name Julian Hyde Low Product pom groupid net.hydromatic Highest Product pom name eigenbase-properties High Product pom organization name Julian Hyde Low Product pom organization url http://www.hydromatic.net Low Product pom parent-artifactid parent Medium Product pom url http://github.com/julianhyde/eigenbase-properties Medium Version file version 1.1.5 High Version Manifest Bundle-Version 1.1.5 High Version pom parent-version 1.1.5 Low Version pom version 1.1.5 Highest
Description:
Memory efficient serialization library. License:
Apache License (v2.0): http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/com/vlkan/flatbuffers/1.2.0-3f79e055/flatbuffers-1.2.0-3f79e055.jar
MD5: b9c68553bce2bcf28de077b28b491d99
SHA1: b4a3fa3b6f768a99c2540e8b96b83bbb051f926c
SHA256: 743f97316096ba6e8528914ea2b062f6a02fc91ec73c98a5a46240d6d67e6898
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name flatbuffers High Vendor jar package name flatbuffers Highest Vendor jar package name flatbuffers Low Vendor jar package name google Low Vendor pom artifactid flatbuffers Highest Vendor pom artifactid flatbuffers Low Vendor pom developer email volkan.yazici@gmail.com Low Vendor pom developer id vy Medium Vendor pom developer name Volkan Yazıcı Medium Vendor pom developer org Volkan Yazıcı's Soap Co. Medium Vendor pom developer org URL http://vlkan.com/ Medium Vendor pom groupid com.vlkan Highest Vendor pom name FlatBuffers Java API High Vendor pom url vy/flatbuffers Highest Product file name flatbuffers High Product jar package name flatbuffers Highest Product jar package name flatbuffers Low Product pom artifactid flatbuffers Highest Product pom developer email volkan.yazici@gmail.com Low Product pom developer id vy Low Product pom developer name Volkan Yazıcı Low Product pom developer org Volkan Yazıcı's Soap Co. Low Product pom developer org URL http://vlkan.com/ Low Product pom groupid com.vlkan Highest Product pom name FlatBuffers Java API High Product pom url vy/flatbuffers High Version pom version 1.2.0-3f79e055 Highest
Description:
Google Gson library License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
MD5: 2f54fc24807a4cad7297012dd8cebf3d
SHA1: a60a5e993c98c864010053cb901b7eab25306568
SHA256: c0328cd07ca9e363a5acd00c1cf4afe8cf554bd6d373834981ba05cebec687fb
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name gson High Vendor jar package name google Highest Vendor jar package name gson Highest Vendor Manifest bundle-contactaddress http://code.google.com/p/google-gson/ Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname com.google.gson Medium Vendor pom artifactid gson Highest Vendor pom artifactid gson Low Vendor pom developer name Inderjeet Singh Medium Vendor pom developer name Jesse Wilson Medium Vendor pom developer name Joel Leitch Medium Vendor pom developer org Google Inc. Medium Vendor pom developer org Square Inc. Medium Vendor pom developer org Trymph Inc. Medium Vendor pom groupid com.google.code.gson Highest Vendor pom name Gson High Vendor pom organization name Google, Inc. High Vendor pom organization url http://www.google.com Medium Vendor pom url http://code.google.com/p/google-gson/ Highest Product file name gson High Product jar package name google Highest Product jar package name gson Highest Product Manifest bundle-contactaddress http://code.google.com/p/google-gson/ Low Product Manifest Bundle-Name Gson Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname com.google.gson Medium Product pom artifactid gson Highest Product pom developer name Inderjeet Singh Low Product pom developer name Jesse Wilson Low Product pom developer name Joel Leitch Low Product pom developer org Google Inc. Low Product pom developer org Square Inc. Low Product pom developer org Trymph Inc. Low Product pom groupid com.google.code.gson Highest Product pom name Gson High Product pom organization name Google, Inc. Low Product pom organization url http://www.google.com Low Product pom url http://code.google.com/p/google-gson/ Medium Version file version 2.2.4 High Version Manifest Bundle-Version 2.2.4 High Version pom version 2.2.4 Highest
CVE-2022-25647 suppress
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
This project is a complete packaging of all the Guava libraries
into a single jar. Individual portions of Guava can be used
by downloading the appropriate module and its dependencies.
Guava (complete) has only one code dependency - javax.annotation,
per the JSR-305 spec.
File Path: /root/.m2/repository/com/google/guava/guava/11.0.2/guava-11.0.2.jarMD5: bed5977336ea1279d2bad3bb258dc8c3SHA1: 35a3c69e19d72743cac83778aecbee68680f63ebSHA256: e144a0ec7f5139c58d4f3729ccfb4240f9c576a1aa43790e4090e09316129ee1Referenced In Projects/Scopes:
livy-integration-test:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name guava High Vendor jar package name collect Low Vendor jar package name common Low Vendor jar package name google Highest Vendor jar package name google Low Vendor pom artifactid guava Highest Vendor pom artifactid guava Low Vendor pom groupid com.google.guava Highest Vendor pom name Guava: Google Core Libraries for Java High Vendor pom parent-artifactid guava-parent Low Product file name guava High Product jar package name collect Low Product jar package name common Low Product jar package name google Highest Product pom artifactid guava Highest Product pom groupid com.google.guava Highest Product pom name Guava: Google Core Libraries for Java High Product pom parent-artifactid guava-parent Medium Version file version 11.0.2 High Version pom version 11.0.2 Highest
CVE-2018-10237 suppress
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion CONFIRM - https://security.netapp.com/advisory/ntap-20220629-0008/ MISC - https://www.oracle.com/security-alerts/cpujan2021.html MISC - https://www.oracle.com/security-alerts/cpujul2020.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 MLIST - [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 MLIST - [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar MLIST - [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version MLIST - [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 MLIST - [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka MLIST - [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core MLIST - [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 MLIST - [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities MLIST - [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes MLIST - [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability MLIST - [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? N/A - N/A OSSINDEX - [CVE-2018-10237] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10237 OSSIndex - https://blog.sonatype.com/2018/11/welcome-back-to-nexus-intelligence-insights/ OSSIndex - https://github.com/google/guava/wiki/CVE-2018-10237 OSSIndex - https://www.securityfocus.com/bid/104133/references REDHAT - RHSA-2018:2423 REDHAT - RHSA-2018:2424 REDHAT - RHSA-2018:2425 REDHAT - RHSA-2018:2428 REDHAT - RHSA-2018:2598 REDHAT - RHSA-2018:2643 REDHAT - RHSA-2018:2740 REDHAT - RHSA-2018:2741 REDHAT - RHSA-2018:2742 REDHAT - RHSA-2018:2743 REDHAT - RHSA-2018:2927 REDHAT - RHSA-2019:2858 REDHAT - RHSA-2019:3149 SECTRACK - 1041707 Vulnerable Software & Versions: (show all )
CVE-2020-8908 suppress
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/guava/guava/16.0.1/guava-16.0.1.jar
MD5: a68693df58191585d9af914cfbe6067a
SHA1: 5fa98cd1a63c99a44dd8d3b77e4762b066a5d0c5
SHA256: a896857d07845d38c7dc5bbc0457b6d9b0f62ecffda010e5e9ec12d561f676d3
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name guava High Vendor jar package name google Highest Vendor Manifest bundle-symbolicname com.google.guava Medium Vendor pom artifactid guava Highest Vendor pom artifactid guava Low Vendor pom groupid com.google.guava Highest Vendor pom name Guava: Google Core Libraries for Java High Vendor pom parent-artifactid guava-parent Low Product file name guava High Product jar package name google Highest Product Manifest Bundle-Name Guava: Google Core Libraries for Java Medium Product Manifest bundle-symbolicname com.google.guava Medium Product pom artifactid guava Highest Product pom groupid com.google.guava Highest Product pom name Guava: Google Core Libraries for Java High Product pom parent-artifactid guava-parent Medium Version file version 16.0.1 High Version Manifest Bundle-Version 16.0.1 High Version pom version 16.0.1 Highest
CVE-2018-10237 suppress
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion CONFIRM - https://security.netapp.com/advisory/ntap-20220629-0008/ MISC - https://www.oracle.com/security-alerts/cpujan2021.html MISC - https://www.oracle.com/security-alerts/cpujul2020.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 MLIST - [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 MLIST - [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar MLIST - [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version MLIST - [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 MLIST - [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka MLIST - [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core MLIST - [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 MLIST - [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities MLIST - [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes MLIST - [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability MLIST - [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? N/A - N/A OSSINDEX - [CVE-2018-10237] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10237 OSSIndex - https://blog.sonatype.com/2018/11/welcome-back-to-nexus-intelligence-insights/ OSSIndex - https://github.com/google/guava/wiki/CVE-2018-10237 OSSIndex - https://www.securityfocus.com/bid/104133/references REDHAT - RHSA-2018:2423 REDHAT - RHSA-2018:2424 REDHAT - RHSA-2018:2425 REDHAT - RHSA-2018:2428 REDHAT - RHSA-2018:2598 REDHAT - RHSA-2018:2643 REDHAT - RHSA-2018:2740 REDHAT - RHSA-2018:2741 REDHAT - RHSA-2018:2742 REDHAT - RHSA-2018:2743 REDHAT - RHSA-2018:2927 REDHAT - RHSA-2019:2858 REDHAT - RHSA-2019:3149 SECTRACK - 1041707 Vulnerable Software & Versions: (show all )
CVE-2020-8908 suppress
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Guice is a lightweight dependency injection framework for Java 5 and above License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/inject/guice/3.0/guice-3.0.jar
MD5: ca1c7ba366884cfcd2cfb48d2395c400
SHA1: 9d84f15fe35e2c716a02979fb62f50a29f38aefa
SHA256: 1a59d0421ffd355cc0b70b42df1c2e9af744c8a2d0c92da379f5fca2f07f1d22
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name guice High Vendor jar package name google Highest Vendor jar package name guice Highest Vendor jar package name inject Highest Vendor Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Vendor Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor Manifest bundle-symbolicname com.google.inject Medium Vendor pom artifactid guice Highest Vendor pom artifactid guice Low Vendor pom groupid com.google.inject Highest Vendor pom name Google Guice - Core Library High Vendor pom parent-artifactid guice-parent Low Product file name guice High Product jar package name dependency Highest Product jar package name google Highest Product jar package name guice Highest Product jar package name inject Highest Product Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Product Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Product Manifest Bundle-Name guice Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product Manifest bundle-symbolicname com.google.inject Medium Product pom artifactid guice Highest Product pom groupid com.google.inject Highest Product pom name Google Guice - Core Library High Product pom parent-artifactid guice-parent Medium Version file version 3.0 High Version pom version 3.0 Highest
Description:
Guice is a lightweight dependency injection framework for Java 5 and above License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/inject/extensions/guice-servlet/3.0/guice-servlet-3.0.jar
MD5: c9f66a5f6a0d840d9057b30853f25b85
SHA1: 610cde0e8da5a8b7d8efb8f0b8987466ffebaaf9
SHA256: 9e72a4b8582888d53c2f4297e93276a3c14c82880124490f2da7b16a9df1c618
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name guice-servlet High Vendor jar package name google Highest Vendor jar package name inject Highest Vendor jar package name servlet Highest Vendor Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Vendor Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor Manifest bundle-symbolicname com.google.inject.servlet Medium Vendor pom artifactid guice-servlet Highest Vendor pom artifactid guice-servlet Low Vendor pom groupid com.google.inject.extensions Highest Vendor pom name Google Guice - Extensions - Servlet High Vendor pom parent-artifactid extensions-parent Low Product file name guice-servlet High Product jar package name google Highest Product jar package name inject Highest Product jar package name servlet Highest Product Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Product Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Product Manifest Bundle-Name guice-servlet Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product Manifest bundle-symbolicname com.google.inject.servlet Medium Product pom artifactid guice-servlet Highest Product pom groupid com.google.inject.extensions Highest Product pom name Google Guice - Extensions - Servlet High Product pom parent-artifactid extensions-parent Medium Version file version 3.0 High Version pom version 3.0 Highest
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/static/bootstrap-3.0.2/js/bootstrap.min.jsMD5: c2e5221c3336abe0dff8568e73cd0daeSHA1: 15a81fe4074f920898e98b1b42cf11bda26da0a8SHA256: 13d9e9ce4061c6b648768b09a36d000a7bfba969d4570cf329f938ede6a8f393Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name bootstrap High Product file name bootstrap High Version file version 3.0.2 High
CVE-2016-10735 suppress
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions from (including) 3.0.0; versions up to (excluding) 3.4.0 cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* CVE-2018-14040 suppress
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions from (including) 4.0.0; versions up to (excluding) 4.1.2 cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:* CVE-2018-14041 suppress
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions from (including) 4.0.0; versions up to (excluding) 4.1.2 cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:* CVE-2018-14042 suppress
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions from (including) 4.0.0; versions up to (excluding) 4.1.2 cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:* CVE-2019-8331 suppress
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 12.1.0; versions up to (excluding) 12.1.5.1 cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 13.0.0; versions up to (excluding) 13.1.3.4 cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 14.0.0; versions up to (excluding) 14.1.2.5 cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 15.0.0; versions up to (excluding) 15.1.0 cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.1 cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* versions from (including) 4.3.0; versions up to (excluding) 4.3.1 cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* versions up to (excluding) 5.19.0 File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/static/dfs-dust.jsMD5: 226ab0c48f0b6577fa189a6ae774800dSHA1: c14aac6c091bb9dd993ed1ab009c5d31ae8adddaSHA256: 82da071d45b8769f43b984da039006e25ee2c65d263a05254eb2683eb8359506Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/hdfs/dfshealth.jsMD5: 68c28bb94d476cf8e67fb4975d7365b4SHA1: 21e243a27bf7d63c573e089b17953f3da1063a81SHA256: 1358a7df491f8ea81ee4cc9a2e89ca1ee8eec2aae9a4c5de96ca9bc50fa7f42cReferenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/static/dust-full-2.0.0.min.jsMD5: 7bf502ca71690989fdefb479db78f3d2SHA1: 6db3768adde65396734a365491b4ae2a2fbd4679SHA256: f11ba668337b8b61319b430164f631648b41949887bb8a7b9cc515f87bba3e3bReferenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/static/dust-helpers-1.1.1.min.jsMD5: 773d66b65a95408b8b1194b5b477c96aSHA1: 82a1e3398cf21a7b14f326091e9216fc4b0d7c84SHA256: ff65ffc9e919f9ab7922d82db9ea9d7840a7543001ccba2a8c4f11195a08a7f6Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/hdfs/explorer.jsMD5: 011e39fe6510e7d92ec29e486263a5f4SHA1: 67774588dd90ddd64e69251d166c53ee36cc1232SHA256: e063a3c6eff9e64631ae9fbd6f1ec56b714d456d2159b4ac08c2871a0bcf9792Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/static/jquery-1.10.2.min.jsMD5: 628072e7212db1e8cdacb22b21752cdaSHA1: 0511abe9863c2ea7084efa7e24d1d86c5b3974f1SHA256: 0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 1.10.2.min High
CVE-2015-9251 suppress
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* versions up to (excluding) 7.0.0.1 cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.0.4.0 cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* versions up to (excluding) 7.2 cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.1; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* versions from (including) 4.3.0.1; versions up to (including) 4.3.0.4 cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* CVE-2019-11358 suppress
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CWE-1321
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.11.0; versions up to (excluding) 1.11.9 cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.12.0; versions up to (excluding) 1.12.6 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.66 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.5.0; versions up to (excluding) 8.5.15 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (excluding) 8.6.15 cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* versions from (including) 3.0.0; versions up to (including) 3.9.4 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 19.1 cpe:2.3:a:oracle:application_service_level_management:13.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_service_level_management:13.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.0; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:diagnostic_assistant:2.12.36:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.5.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_retail_customer_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_performance_insight:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:knowledge:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (including) 8.6.3 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2.0; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:primavera_gateway:15.2.18:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.7; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_mobile_applications:*:*:*:*:*:*:*:* versions up to (including) 19.8 cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:system_utilities:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:transportation_management:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_mobile_workforce_management:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* CVE-2020-11022 suppress
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.2; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* versions from (including) 18.1; versions up to (including) 20.1 cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* versions up to (excluding) 21.1.2 cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.2.2 cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6.0.0; versions up to (including) 8.1.0.0.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 CVE-2020-11023 suppress
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.0.3; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 20.2 cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.1; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* versions up to (excluding) 2.12.41 cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:* versions up to (including) 20.12 cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 File Path: /root/.m2/repository/org/apache/hadoop/hadoop-hdfs/2.7.3/hadoop-hdfs-2.7.3-tests.jar/webapps/secondary/snn.jsMD5: 2b7afe0e647225ddbfd016116925c67bSHA1: a1d65967b6d20981d7d4365bc84369670b5286d3SHA256: 9cff0528fee712dd51a99f346f08bdaabb916d3a4a1f58dbc668e63680a4a245Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/jquery/jquery-1.8.2.min.js.gz/jquery-1.8.2.min.jsMD5: cfa9051cc0b05eb519f1e16b2a6645d7SHA1: 149b5180cb9de3f646fc26802440a6ac6e758d40SHA256: f23d4b309b72743aa8afe1f8c98a25b3ee31246fa572c66d9d8cb1982cae4fbcReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 1.8.2.min High
CVE-2012-6708 suppress
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 1.9.0 CVE-2015-9251 suppress
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* versions up to (excluding) 7.0.0.1 cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.0.4.0 cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* versions up to (excluding) 7.2 cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.1; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* versions from (including) 4.3.0.1; versions up to (including) 4.3.0.4 cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* CVE-2019-11358 suppress
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CWE-1321
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.11.0; versions up to (excluding) 1.11.9 cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.12.0; versions up to (excluding) 1.12.6 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.66 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.5.0; versions up to (excluding) 8.5.15 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (excluding) 8.6.15 cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* versions from (including) 3.0.0; versions up to (including) 3.9.4 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 19.1 cpe:2.3:a:oracle:application_service_level_management:13.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_service_level_management:13.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.0; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:diagnostic_assistant:2.12.36:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.5.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_retail_customer_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_performance_insight:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:knowledge:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (including) 8.6.3 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2.0; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:primavera_gateway:15.2.18:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.7; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_mobile_applications:*:*:*:*:*:*:*:* versions up to (including) 19.8 cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:system_utilities:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:transportation_management:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_mobile_workforce_management:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* CVE-2020-11022 suppress
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.2; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* versions from (including) 18.1; versions up to (including) 20.1 cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* versions up to (excluding) 21.1.2 cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.2.2 cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6.0.0; versions up to (including) 8.1.0.0.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 CVE-2020-11023 suppress
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.0.3; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 20.2 cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.1; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* versions up to (excluding) 2.12.41 cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:* versions up to (including) 20.12 cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/jquery/jquery-ui-1.9.1.custom.min.js.gz/jquery-ui-1.9.1.custom.min.jsMD5: ab92e49c769e9593ff52cbdb48a9dd03SHA1: 43751816cc0b6480e8fb3b2398952d6a865e8b89SHA256: 1fb0b66548624c8cf9ebf2d0c81970910ab0c8031a8ada6f8e6f884114344e8dReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jquery-ui High Vendor file name jquery-ui-dialog High Product file name jquery-ui High Product file name jquery-ui-dialog High Version file version 1.9.1 High
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/dt-1.9.4/js/jquery.dataTables.min.js.gz/jquery.dataTables.min.jsMD5: dd02e31cea8b6f07d665e5a0d0b53f50SHA1: 98c517335f66552467f2372e1cd650f93cbffeafSHA256: 1783d49bec463c334d276a72d3b239f6366f6487c2e77e544838e8c6dcc657d9Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/jt/jquery.jstree.js.gz/jquery.jstree.jsMD5: 90107823a51eda2bbe77a6b2baac3466SHA1: 89944976806fcac399356f8d698952473f936489SHA256: 9dcb812e3e7f2c38f0c93a37e4aa923ce3a74ab65a97656957ff3fb780baf3d0Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/dt-sorting/natural.jsMD5: 6119b176fc9ded71d13d2d9e4b166ba9SHA1: 2f5ecc90d7e4a8d6922c345cadf4952be2eb0d6dSHA256: 7abeaadbaef39a5a540701143e8bdc05a82be5030b69eb03373d3b7a84c0225fReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-common/2.7.3/hadoop-yarn-common-2.7.3.jar/webapps/static/yarn.dt.plugins.jsMD5: 92892ffa06992a58682b3df403910d8fSHA1: 6c45673282b91be2d21977d3ffb53797179e4854SHA256: f3b3e49f23c491bbd0d3e15fbd1a7e60315e6cac4c2e8ba7be7ab1c058880ba1Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/apache/hadoop/hadoop-yarn-server-common/2.7.3/hadoop-yarn-server-common-2.7.3.jarMD5: a658771fb65ec924560a7e0022aafa39SHA1: 65f027fd3e81ceef40a64c53d02915da735524dfSHA256: 53272b885ab327ad101fded390c82410a717cf7326e197daa2867e77d9cf1a00Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name hadoop-yarn-server-common High Vendor jar package name apache Highest Vendor jar package name apache Low Vendor jar package name hadoop Highest Vendor jar package name hadoop Low Vendor jar package name server Highest Vendor jar package name yarn Highest Vendor jar package name yarn Low Vendor pom artifactid hadoop-yarn-server-common Highest Vendor pom artifactid hadoop-yarn-server-common Low Vendor pom groupid org.apache.hadoop Highest Vendor pom name hadoop-yarn-server-common High Vendor pom parent-artifactid hadoop-yarn-server Low Product file name hadoop-yarn-server-common High Product jar package name apache Highest Product jar package name hadoop Highest Product jar package name hadoop Low Product jar package name server Highest Product jar package name server Low Product jar package name yarn Highest Product jar package name yarn Low Product pom artifactid hadoop-yarn-server-common Highest Product pom groupid org.apache.hadoop Highest Product pom name hadoop-yarn-server-common High Product pom parent-artifactid hadoop-yarn-server Medium Version file version 2.7.3 High Version pom version 2.7.3 Highest
Related Dependencies CVE-2017-15718 suppress
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-25168 suppress
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136). CWE-88 Argument Injection or Modification
CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-26612 suppress
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2016-6811 suppress
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. CWE-264 Permissions, Privileges, and Access Controls
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2018-8009 suppress
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (6.5) Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-8029 suppress
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-9492 suppress
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification. CWE-863 Incorrect Authorization
CVSSv2:
Base Score: MEDIUM (6.5) Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-33036 suppress
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-3166 suppress
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv2:
Base Score: MEDIUM (4.6) Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11768 suppress
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-1296 suppress
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2017-15713 suppress
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Fast, efficient Java serialization License:
New BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/com.esotericsoftware.kryo/kryo/pom.xml
MD5: b977301578f13902a8f073b155495ea5
SHA1: ec1516f1bd3e83783e1bc44d01f6d18ef0249174
SHA256: 24f9bcbb62e6abc47a734288f3b7230dd591f16d95c21f3f2227c37c17613523
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid kryo Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware.kryo Highest Vendor pom name Kryo High Vendor pom url http://code.google.com/p/kryo/ Highest Product pom artifactid kryo Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware.kryo Highest Product pom name Kryo High Product pom url http://code.google.com/p/kryo/ Medium Version pom version 2.21 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/org.spark-project.hive.shims/hive-shims-0.20S/pom.xmlMD5: 266504a2f32a7725a5e8b144f5b9fa1dSHA1: 4853835dc25ee31dc4f7340cc8da5df6dc65a1a7SHA256: 5fae5fba15177f10a11e4d16fa993166a87ae082d0bf3f70dfb3201e78b28773Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-shims-0.20S Low Vendor pom groupid org.spark-project.hive.shims Highest Vendor pom name Hive Shims 0.20S High Vendor pom parent-artifactid hive Low Vendor pom parent-groupid org.spark-project.hive Medium Product pom artifactid hive-shims-0.20S Highest Product pom groupid org.spark-project.hive.shims Highest Product pom name Hive Shims 0.20S High Product pom parent-artifactid hive Medium Product pom parent-groupid org.spark-project.hive Medium Version pom version 1.2.1.spark2 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/org.spark-project.hive.shims/hive-shims-0.23/pom.xmlMD5: 209a38acc818b2f4ce9a1d2237f35232SHA1: 9d694ad80dcf46b3de2beac780bd1a8a0264ec91SHA256: 9c4c06723680baea76dcbca5a78e9bd943ded28b3797749c6176eda139e5d3edReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-shims-0.23 Low Vendor pom groupid org.spark-project.hive.shims Highest Vendor pom name Hive Shims 0.23 High Vendor pom parent-artifactid hive Low Vendor pom parent-groupid org.spark-project.hive Medium Product pom artifactid hive-shims-0.23 Highest Product pom groupid org.spark-project.hive.shims Highest Product pom name Hive Shims 0.23 High Product pom parent-artifactid hive Medium Product pom parent-groupid org.spark-project.hive Medium Version pom version 1.2.1.spark2 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/org.spark-project.hive.shims/hive-shims-common/pom.xmlMD5: 5dab1da35d7ac94d1673b4f58759a163SHA1: f92b2d82ab373e18ccaf5692beefa75909df6ee3SHA256: 90ef9b752ef8281b27dd6b422b45719c78b8798e6d7404c5c7f38169e6552513Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-shims-common Low Vendor pom groupid org.spark-project.hive.shims Highest Vendor pom name Hive Shims Common High Vendor pom parent-artifactid hive Low Vendor pom parent-groupid org.spark-project.hive Medium Product pom artifactid hive-shims-common Highest Product pom groupid org.spark-project.hive.shims Highest Product pom name Hive Shims Common High Product pom parent-artifactid hive Medium Product pom parent-groupid org.spark-project.hive Medium Version pom version 1.2.1.spark2 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/org.spark-project.hive/hive-common/pom.xmlMD5: 10da3a85e7d8d3958f7410dbd09c44c5SHA1: 01642cb2c9671092ed35624ee9ed6bccd22aa38dSHA256: 4abe1a0c37336d6288e977f973d2786f7c9519acea3f6f404addbab4845098b2Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-common Low Vendor pom groupid org.spark-project.hive Highest Vendor pom name Hive Common High Vendor pom parent-artifactid hive Low Product pom artifactid hive-common Highest Product pom groupid org.spark-project.hive Highest Product pom name Hive Common High Product pom parent-artifactid hive Medium Version pom version 1.2.1.spark2 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/org.spark-project.hive/hive-serde/pom.xmlMD5: 7c4748654b41d6b1b03beef8d3b231ccSHA1: 9a7bf1bee42d676a2df7763eaa7fafafc996e738SHA256: 12a297bd4531dba968bd4cf16b9b08da6919e8e660f3bce0cf43b6815c96efa3Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-serde Low Vendor pom groupid org.spark-project.hive Highest Vendor pom name Hive Serde High Vendor pom parent-artifactid hive Low Product pom artifactid hive-serde Highest Product pom groupid org.spark-project.hive Highest Product pom name Hive Serde High Product pom parent-artifactid hive Medium Version pom version 1.2.1.spark2 Highest
File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jarMD5: 24a49abbd771544bbcae9c0314eb5ec3SHA1: 7a6236e2fce787814560970a49a1c517e6de1927SHA256: f5921f426ab86899d2386e4152281514743c37f449681f4f3ec8963161073bfeReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name hive-exec High Vendor jar package name apache Highest Vendor jar package name hive Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.spark-project.hive Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid hive-exec Highest Vendor pom artifactid hive-exec Low Vendor pom groupid org.spark-project.hive Highest Vendor pom name Hive Query Language High Vendor pom parent-artifactid hive Low Product file name hive-exec High Product jar package name hive Highest Product Manifest Implementation-Title Hive Query Language High Product Manifest specification-title Hive Query Language Medium Product pom artifactid hive-exec Highest Product pom groupid org.spark-project.hive Highest Product pom name Hive Query Language High Product pom parent-artifactid hive Medium Version Manifest Implementation-Version 1.2.1.spark2 High Version pom version 1.2.1.spark2 Highest
Related Dependencies hive-metastore-1.2.1.spark2.jarFile Path: /root/.m2/repository/org/spark-project/hive/hive-metastore/1.2.1.spark2/hive-metastore-1.2.1.spark2.jar MD5: 60c586800c29568f2712d28b85fda43a SHA1: 1fde9720e4ead8c07b28c45011e231277c79b7a1 SHA256: b6eb09c0eefe60b3da16cd02fbc71e07ef64659955976ee947877891922c4b2e pkg:maven/org.spark-project.hive/hive-metastore@1.2.1.spark2 CVE-2018-17190 suppress
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-9480 suppress
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). CWE-306 Missing Authentication for Critical Function
CVSSv2:
Base Score: HIGH (9.3) Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-1282 suppress
This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
Vulnerable Software & Versions:
CVE-2022-33891 suppress
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2015-7521 suppress
The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations. CWE-287 Improper Authentication
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2018-11777 suppress
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.5) Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:N CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-4125 suppress
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2016-3083 suppress
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-10099 suppress
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs. CWE-312 Cleartext Storage of Sensitive Information
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2020-13949 suppress
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-34538 suppress
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. CWE-306 Missing Authentication for Critical Function
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
CVE-2021-38296 suppress
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later CWE-294 Authentication Bypass by Capture-replay
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2017-7678 suppress
In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions:
CVE-2020-1926 suppress
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8 CWE-203 Information Exposure Through Discrepancy
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2018-11760 suppress
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1. NVD-CWE-noinfo
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-31777 suppress
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:
Base Score: MEDIUM (5.4) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-1334 suppress
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. CWE-200 Information Exposure
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.7) Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-1314 suppress
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics. CWE-862 Missing Authorization
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-1284 suppress
In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: LOW (3.7) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Minimal overhead Java logging License:
New BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/minlog-1.2.jar
MD5: 7a765ca0eb45dd86803ac22f9f0d7e4a
SHA1: 48686dd2bedabd935e9758fedde6f774b1d131af
SHA256: 986bba7a2c1334e9f5384db5a148038689c4163d0c41df15512bd095d9108a2c
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name minlog High Vendor jar package name esotericsoftware Highest Vendor jar package name esotericsoftware Low Vendor jar package name minlog Highest Vendor jar package name minlog Low Vendor pom artifactid minlog Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware.minlog Highest Vendor pom name MinLog High Vendor pom url http://code.google.com/p/minlog/ Highest Product file name minlog High Product jar package name esotericsoftware Highest Product jar package name minlog Highest Product jar package name minlog Low Product pom artifactid minlog Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware.minlog Highest Product pom name MinLog High Product pom url http://code.google.com/p/minlog/ Medium Version file version 1.2 High Version pom version 1.2 Highest
Description:
A library for instantiating Java objects License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/objenesis-1.2.jar
MD5: bee117291d50b41b8e8cf0ac5435df1d
SHA1: bfcb0539a071a4c5a30690388903ac48c0667f2a
SHA256: 8c65c237578149b87c6aedf2bd93a4925e8dcb8dd7ec5b0c2f9eaf6cfd09ba70
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name objenesis High Vendor jar package name instantiator Low Vendor jar package name objenesis Highest Vendor jar package name objenesis Low Vendor Manifest bundle-symbolicname org.objenesis Medium Vendor Manifest Implementation-Vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita High Vendor Manifest Implementation-Vendor-Id org.objenesis Medium Vendor Manifest originally-created-by 1.6.0_15 (Sun Microsystems Inc.) Low Vendor Manifest specification-vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita Low Product file name objenesis High Product jar package name instantiator Low Product jar package name objenesis Highest Product jar package name sun Highest Product Manifest Bundle-Name Objenesis Medium Product Manifest bundle-symbolicname org.objenesis Medium Product Manifest Implementation-Title Objenesis High Product Manifest originally-created-by 1.6.0_15 (Sun Microsystems Inc.) Low Product Manifest specification-title Objenesis Medium Version file version 1.2 High Version Manifest Implementation-Version 1.2 High
Description:
High performance Java reflection using code generation License:
New BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/reflectasm-1.07-shaded.jar
MD5: 1782c2033ee4d70c378e937e601f37f5
SHA1: 142bb428f45d1fe67e343d04955eec6ebc0b757f
SHA256: 518a74399de4e222f0d2fc859f0f86def8c089f5c200c8c3848ebc2b16ab50fe
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name reflectasm High Vendor jar package name esotericsoftware Highest Vendor jar package name esotericsoftware Low Vendor jar package name reflectasm Highest Vendor jar package name reflectasm Low Vendor jar package name shaded Low Vendor pom artifactid reflectasm Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware.reflectasm Highest Vendor pom name ReflectASM High Vendor pom url http://code.google.com/p/reflectasm/ Highest Product file name reflectasm High Product jar package name esotericsoftware Highest Product jar package name org Low Product jar package name reflectasm Highest Product jar package name reflectasm Low Product jar package name shaded Low Product pom artifactid reflectasm Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware.reflectasm Highest Product pom name ReflectASM High Product pom url http://code.google.com/p/reflectasm/ Medium Version file version 1.07 High Version pom version 1.07 Highest
Description:
${project.name} License:
https://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/hk2/hk2-api/2.4.0-b34/hk2-api-2.4.0-b34.jar
MD5: 2972849752ed511bd069812ba2b29d2d
SHA1: 1017432e219dbd1d4a1121b2d7e87c5b2f0bcfb9
SHA256: 6eb071aaea327015ac3da18d5066c364c1a39978f4b6f94644158675ca5b9ced
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name hk2-api High Vendor jar package name api Highest Vendor jar package name glassfish Highest Vendor jar package name hk2 Highest Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.api Medium Vendor pom artifactid hk2-api Highest Vendor pom artifactid hk2-api Low Vendor pom groupid org.glassfish.hk2 Highest Vendor pom name HK2 API module High Vendor pom parent-artifactid hk2-parent Low Product file name hk2-api High Product jar package name api Highest Product jar package name glassfish Highest Product jar package name hk2 Highest Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name HK2 API module Medium Product Manifest bundle-symbolicname org.glassfish.hk2.api Medium Product pom artifactid hk2-api Highest Product pom groupid org.glassfish.hk2 Highest Product pom name HK2 API module High Product pom parent-artifactid hk2-parent Medium Version pom version 2.4.0-b34 Highest
Description:
${project.name} License:
https://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/hk2/hk2-locator/2.4.0-b34/hk2-locator-2.4.0-b34.jar
MD5: 09eda1a8dd33d465ec7bac9536f3eaf7
SHA1: 1451fc3e5b7f00d7a5ca0feaff2c1bf68be5ac91
SHA256: ea47ebf7ed56ef751055710cfad36840bcc36383cf387c4a963b41447c066f8f
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name hk2-locator High Vendor jar package name hk2 Highest Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.locator Medium Vendor pom artifactid hk2-locator Highest Vendor pom artifactid hk2-locator Low Vendor pom groupid org.glassfish.hk2 Highest Vendor pom name ServiceLocator Default Implementation High Vendor pom parent-artifactid hk2-parent Low Product file name hk2-locator High Product jar package name hk2 Highest Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name ServiceLocator Default Implementation Medium Product Manifest bundle-symbolicname org.glassfish.hk2.locator Medium Product pom artifactid hk2-locator Highest Product pom groupid org.glassfish.hk2 Highest Product pom name ServiceLocator Default Implementation High Product pom parent-artifactid hk2-parent Medium Version pom version 2.4.0-b34 Highest
File Path: /root/.m2/repository/org/glassfish/hk2/hk2-utils/2.4.0-b34/hk2-utils-2.4.0-b34.jar/META-INF/maven/org.jvnet/tiger-types/pom.xmlMD5: 51329dba505e7cc4a9bc2719cf195be0SHA1: 5855a7ee03b816073c2b448bce93319bd71f7029SHA256: 58794aca99cadb3aab687b56fd6d84871956590323dd0ea5d611db759e78c6b9Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid tiger-types Low Vendor pom groupid org.jvnet Highest Vendor pom name Type arithmetic library for Java5 High Vendor pom parent-artifactid jvnet-parent Low Vendor pom parent-groupid net.java Medium Product pom artifactid tiger-types Highest Product pom groupid org.jvnet Highest Product pom name Type arithmetic library for Java5 High Product pom parent-artifactid jvnet-parent Medium Product pom parent-groupid net.java Medium Version pom parent-version 1.4 Low Version pom version 1.4 Highest
Description:
${project.name} License:
https://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/hk2/hk2-utils/2.4.0-b34/hk2-utils-2.4.0-b34.jar
MD5: f0c9e9df24ad2c2feb1f950b82146245
SHA1: aacce18411fffef9621d8fc91464ca0477119c38
SHA256: 70211b1f918819bf6afbf69d3d19d4ae6e2a75d6e26f6c39ba9f20eb8e5612d7
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name hk2-utils High Vendor jar package name glassfish Highest Vendor jar package name hk2 Highest Vendor jar package name utilities Highest Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.utils Medium Vendor Manifest originally-created-by Apache Maven Low Vendor Manifest service foo Low Vendor pom artifactid hk2-utils Highest Vendor pom artifactid hk2-utils Low Vendor pom groupid org.glassfish.hk2 Highest Vendor pom name HK2 Implementation Utilities High Vendor pom parent-artifactid hk2-parent Low Product file name hk2-utils High Product jar package name glassfish Highest Product jar package name hk2 Highest Product jar package name utilities Highest Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name HK2 Implementation Utilities Medium Product Manifest bundle-symbolicname org.glassfish.hk2.utils Medium Product Manifest originally-created-by Apache Maven Low Product Manifest service foo Low Product pom artifactid hk2-utils Highest Product pom groupid org.glassfish.hk2 Highest Product pom name HK2 Implementation Utilities High Product pom parent-artifactid hk2-parent Medium Version pom version 2.4.0-b34 Highest
Description:
High Performance Primitive Collections.
Fundamental data structures (maps, sets, lists, stacks, queues) generated for
combinations of object and primitive types to conserve JVM memory and speed
up execution. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/carrotsearch/hppc/0.7.2/hppc-0.7.2.jar
MD5: 7f4c5c74b8dc781db19abe151903a187
SHA1: 710398361f2ae8fd594a133e3619045c16b24137
SHA256: 7b3dd6661e83e313d70b4aa82c5180bb39535e536a3435fa741fff9727433b6a
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name hppc High Vendor jar package name carrotsearch Highest Vendor jar package name hppc Highest Vendor Manifest bundle-docurl http://www.carrotsearch.com Low Vendor Manifest bundle-symbolicname com.carrotsearch.hppc Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom artifactid hppc Highest Vendor pom artifactid hppc Low Vendor pom groupid com.carrotsearch Highest Vendor pom name HPPC Collections High Vendor pom parent-artifactid hppc-parent Low Product file name hppc High Product jar package name carrotsearch Highest Product jar package name hppc Highest Product Manifest bundle-docurl http://www.carrotsearch.com Low Product Manifest Bundle-Name HPPC Collections Medium Product Manifest bundle-symbolicname com.carrotsearch.hppc Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product pom artifactid hppc Highest Product pom groupid com.carrotsearch Highest Product pom name HPPC Collections High Product pom parent-artifactid hppc-parent Medium Version file version 0.7.2 High Version Manifest Bundle-Version 0.7.2 High Version pom version 0.7.2 Highest
Description:
Core Jackson abstractions, basic JSON streaming API implementation
File Path: /root/.m2/repository/org/apache/htrace/htrace-core/3.1.0-incubating/htrace-core-3.1.0-incubating.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xmlMD5: b5ed6cb7f987a4da86141638b1538d81SHA1: ed8235ea6d84480833675e709b415bde24ce25f7SHA256: 8310978da8c7013ecaaba13c9b41b75ab3a09797ae4b946ae5e1614088f995d7Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor pom artifactid jackson-core Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom name Jackson-core High Vendor pom parent-artifactid jackson-parent Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest Product hint analyzer product java8 Highest Product hint analyzer product modules Highest Product pom artifactid jackson-core Highest Product pom groupid com.fasterxml.jackson.core Highest Product pom name Jackson-core High Product pom parent-artifactid jackson-parent Medium Product pom parent-groupid com.fasterxml.jackson Medium Product pom url http://wiki.fasterxml.com/JacksonHome Medium Version pom parent-version 2.4.0 Low Version pom version 2.4.0 Highest
Related Dependencies htrace-core-3.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-annotations:2.4.0)File Path: /root/.m2/repository/org/apache/htrace/htrace-core/3.1.0-incubating/htrace-core-3.1.0-incubating.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-annotations/pom.xml MD5: 556310b593b9688b85686409e0bd5377 SHA1: 2b75fa41636e5d02edc961ee9c68e6f041dc85a9 SHA256: 63e2e01157c8964913ef8bb0e69cec0d363d31129089206f7fb07ee5438359c0 pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.4.0 CVE-2018-1000873 suppress
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
General data-binding functionality for Jackson: works on core streaming API File Path: /root/.m2/repository/org/apache/htrace/htrace-core/3.1.0-incubating/htrace-core-3.1.0-incubating.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xmlMD5: d3f7afe903419aa0c03f9cf8682e1a69SHA1: 3c0d06b6c0a9f4135fcf5c5557c751c0cd066c0cSHA256: 083be927bdddaf1e992d0e9f0fff509b60f35deea307216d8ba773f065a6f30cReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor pom artifactid jackson-databind Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom name jackson-databind High Vendor pom parent-artifactid jackson-parent Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest Product hint analyzer product java8 Highest Product hint analyzer product modules Highest Product pom artifactid jackson-databind Highest Product pom groupid com.fasterxml.jackson.core Highest Product pom name jackson-databind High Product pom parent-artifactid jackson-parent Medium Product pom parent-groupid com.fasterxml.jackson Medium Product pom url http://wiki.fasterxml.com/JacksonHome Medium Version pom parent-version 2.4.0 Low Version pom version 2.4.0 Highest
CVE-2018-7489 suppress
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. CWE-502 Deserialization of Untrusted Data, CWE-184 Incomplete Blacklist
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-7525 (OSSINDEX)suppress
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. CWE-184 Incomplete Blacklist
CVSSv2:
Base Score: HIGH (9.8) Vector: /AV:N/AC:L/Au:/C:H/I:H/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.4.0:*:*:*:*:*:*:* CVE-2020-35490 suppress
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-35491 suppress
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-36518 suppress
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CWE-787 Out-of-bounds Write
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42003 suppress
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1 CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42004 suppress
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-1000873 suppress
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems. File Path: /root/.m2/repository/org/apache/htrace/htrace-core/3.1.0-incubating/htrace-core-3.1.0-incubating.jar/META-INF/maven/commons-logging/commons-logging/pom.xmlMD5: 976d812430b8246deeaf2ea54610f263SHA1: 76672afb562b9e903674ad3a544cdf2092f1faa3SHA256: d0f2e16d054e8bb97add9ca26525eb2346f692809fcd2a28787da8ceb3c35ee8Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor pom artifactid commons-logging Low Vendor pom developer email baliuka@apache.org Low Vendor pom developer email costin at apache dot org Low Vendor pom developer email craigmcc at apache org Low Vendor pom developer email dennisl@apache.org Low Vendor pom developer email donaldp at apache dot org Low Vendor pom developer email morgand at apache dot org Low Vendor pom developer email rdonkin at apache dot org Low Vendor pom developer email rsitze at apache dot org Low Vendor pom developer email rwaldhoff at apache org Low Vendor pom developer email sanders at apache dot org Low Vendor pom developer email skitching@apache.org Low Vendor pom developer id baliuka Medium Vendor pom developer id bstansberry Medium Vendor pom developer id costin Medium Vendor pom developer id craigmcc Medium Vendor pom developer id dennisl Medium Vendor pom developer id donaldp Medium Vendor pom developer id morgand Medium Vendor pom developer id rdonkin Medium Vendor pom developer id rsitze Medium Vendor pom developer id rwaldhoff Medium Vendor pom developer id sanders Medium Vendor pom developer id skitching Medium Vendor pom developer name Brian Stansberry Medium Vendor pom developer name Costin Manolache Medium Vendor pom developer name Craig McClanahan Medium Vendor pom developer name Dennis Lundberg Medium Vendor pom developer name Juozas Baliuka Medium Vendor pom developer name Morgan Delagrange Medium Vendor pom developer name Peter Donald Medium Vendor pom developer name Richard Sitze Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Rodney Waldhoff Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Simon Kitching Medium Vendor pom developer org Apache Medium Vendor pom developer org Apache Software Foundation Medium Vendor pom groupid commons-logging Highest Vendor pom name Commons Logging High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url http://commons.apache.org/logging Highest Product pom artifactid commons-logging Highest Product pom developer email baliuka@apache.org Low Product pom developer email costin at apache dot org Low Product pom developer email craigmcc at apache org Low Product pom developer email dennisl@apache.org Low Product pom developer email donaldp at apache dot org Low Product pom developer email morgand at apache dot org Low Product pom developer email rdonkin at apache dot org Low Product pom developer email rsitze at apache dot org Low Product pom developer email rwaldhoff at apache org Low Product pom developer email sanders at apache dot org Low Product pom developer email skitching@apache.org Low Product pom developer id baliuka Low Product pom developer id bstansberry Low Product pom developer id costin Low Product pom developer id craigmcc Low Product pom developer id dennisl Low Product pom developer id donaldp Low Product pom developer id morgand Low Product pom developer id rdonkin Low Product pom developer id rsitze Low Product pom developer id rwaldhoff Low Product pom developer id sanders Low Product pom developer id skitching Low Product pom developer name Brian Stansberry Low Product pom developer name Costin Manolache Low Product pom developer name Craig McClanahan Low Product pom developer name Dennis Lundberg Low Product pom developer name Juozas Baliuka Low Product pom developer name Morgan Delagrange Low Product pom developer name Peter Donald Low Product pom developer name Richard Sitze Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Rodney Waldhoff Low Product pom developer name Scott Sanders Low Product pom developer name Simon Kitching Low Product pom developer org Apache Low Product pom developer org Apache Software Foundation Low Product pom groupid commons-logging Highest Product pom name Commons Logging High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url http://commons.apache.org/logging Medium Version pom parent-version 1.1.1 Low Version pom version 1.1.1 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
File Path: /root/.m2/repository/org/apache/htrace/htrace-core/3.1.0-incubating/htrace-core-3.1.0-incubating.jarMD5: c49a4662d691a09eed10e0a35dd73299SHA1: f73606e7c9ede5802335c290bf47490ad6d51df3SHA256: d96c869afaf65315ece8ca09673b187557e9dbaad31df24467a5aa759812188dReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name htrace-core High Vendor jar package name apache Highest Vendor jar package name htrace Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.htrace Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid htrace-core Highest Vendor pom artifactid htrace-core Low Vendor pom groupid org.apache.htrace Highest Vendor pom name htrace-core High Vendor pom parent-artifactid htrace Low Vendor pom url http://incubator.apache.org/projects/htrace.html Highest Product file name htrace-core High Product jar package name apache Highest Product jar package name htrace Highest Product Manifest Implementation-Title htrace-core High Product Manifest specification-title htrace-core Medium Product pom artifactid htrace-core Highest Product pom groupid org.apache.htrace Highest Product pom name htrace-core High Product pom parent-artifactid htrace Medium Product pom url http://incubator.apache.org/projects/htrace.html Medium Version Manifest Implementation-Version 3.1.0-incubating High Version pom version 3.1.0-incubating Highest
Description:
Apache HttpComponents Client
File Path: /root/.m2/repository/org/apache/httpcomponents/httpclient/4.5.3/httpclient-4.5.3.jarMD5: 1965ebb7aca0f9f8faaed3870d8cf689SHA1: d1577ae15f01ef5438c5afc62162457c00a34713SHA256: db3d1b6c2d6a5e5ad47577ad61854e2f0e0936199b8e05eb541ed52349263135Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-repl_2.11:provided livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name httpclient High Vendor jar package name apache Highest Vendor jar package name client Highest Vendor jar package name httpclient Highest Vendor Manifest implementation-build tags/4.5.3-RC1/httpclient@r1779741; 2017-01-21 16:58:35+0100 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest url http://hc.apache.org/httpcomponents-client Low Vendor pom artifactid httpclient Highest Vendor pom artifactid httpclient Low Vendor pom groupid org.apache.httpcomponents Highest Vendor pom name Apache HttpClient High Vendor pom parent-artifactid httpcomponents-client Low Vendor pom url http://hc.apache.org/httpcomponents-client Highest Product file name httpclient High Product jar package name apache Highest Product jar package name client Highest Product jar package name http Highest Product jar package name httpclient Highest Product Manifest implementation-build tags/4.5.3-RC1/httpclient@r1779741; 2017-01-21 16:58:35+0100 Low Product Manifest Implementation-Title HttpComponents Apache HttpClient High Product Manifest specification-title HttpComponents Apache HttpClient Medium Product Manifest url http://hc.apache.org/httpcomponents-client Low Product pom artifactid httpclient Highest Product pom groupid org.apache.httpcomponents Highest Product pom name Apache HttpClient High Product pom parent-artifactid httpcomponents-client Medium Product pom url http://hc.apache.org/httpcomponents-client Medium Version file version 4.5.3 High Version Manifest Implementation-Version 4.5.3 High Version pom version 4.5.3 Highest
CVE-2020-13956 suppress
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Apache HttpComponents Core (blocking I/O)
File Path: /root/.m2/repository/org/apache/httpcomponents/httpcore/4.4.4/httpcore-4.4.4.jarMD5: e7776f2b03a4c62d691a90d3c68c93c0SHA1: b31526a230871fbe285fbcbe2813f9c0839ae9b0SHA256: f7bc09dc8a7003822d109634ffd3845d579d12e725ae54673e323a7ce7f5e325Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-repl_2.11:provided livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name httpcore High Vendor jar package name apache Highest Vendor Manifest implementation-build tags/4.4.4-RC1/httpcore@r1710658; 2015-10-26 18:15:56+0100 Low Vendor Manifest implementation-url http://hc.apache.org/httpcomponents-core-ga Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest url http://hc.apache.org/httpcomponents-core-ga Low Vendor pom artifactid httpcore Highest Vendor pom artifactid httpcore Low Vendor pom groupid org.apache.httpcomponents Highest Vendor pom name Apache HttpCore High Vendor pom parent-artifactid httpcomponents-core Low Vendor pom url http://hc.apache.org/httpcomponents-core-ga Highest Product file name httpcore High Product jar package name apache Highest Product jar package name http Highest Product Manifest implementation-build tags/4.4.4-RC1/httpcore@r1710658; 2015-10-26 18:15:56+0100 Low Product Manifest Implementation-Title HttpComponents Apache HttpCore High Product Manifest implementation-url http://hc.apache.org/httpcomponents-core-ga Low Product Manifest specification-title HttpComponents Apache HttpCore Medium Product Manifest url http://hc.apache.org/httpcomponents-core-ga Low Product pom artifactid httpcore Highest Product pom groupid org.apache.httpcomponents Highest Product pom name Apache HttpCore High Product pom parent-artifactid httpcomponents-core Medium Product pom url http://hc.apache.org/httpcomponents-core-ga Medium Version file version 4.4.4 High Version Manifest Implementation-Version 4.4.4 High Version pom version 4.4.4 Highest
Description:
Apache HttpComponents HttpClient - MIME coded entities
File Path: /root/.m2/repository/org/apache/httpcomponents/httpmime/4.5.1/httpmime-4.5.1.jarMD5: 2ea8e5d4753d0231620062e225de4162SHA1: 96823b9421ebb9f490dec837d9f96134e864e3a7SHA256: 8376801929b82e1d64cbf554abc60be94cfe039a874f8e6f371d06dbd97b99dfReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name httpmime High Vendor jar package name apache Highest Vendor jar package name mime Highest Vendor Manifest implementation-build tags/4.5.1-RC1/httpmime@r1702448; 2015-09-11 14:53:18+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest url http://hc.apache.org/httpcomponents-client Low Vendor pom artifactid httpmime Highest Vendor pom artifactid httpmime Low Vendor pom groupid org.apache.httpcomponents Highest Vendor pom name Apache HttpClient Mime High Vendor pom parent-artifactid httpcomponents-client Low Vendor pom url http://hc.apache.org/httpcomponents-client Highest Product file name httpmime High Product jar package name apache Highest Product jar package name http Highest Product jar package name mime Highest Product Manifest implementation-build tags/4.5.1-RC1/httpmime@r1702448; 2015-09-11 14:53:18+0200 Low Product Manifest Implementation-Title HttpComponents Apache HttpClient Mime High Product Manifest specification-title HttpComponents Apache HttpClient Mime Medium Product Manifest url http://hc.apache.org/httpcomponents-client Low Product pom artifactid httpmime Highest Product pom groupid org.apache.httpcomponents Highest Product pom name Apache HttpClient Mime High Product pom parent-artifactid httpcomponents-client Medium Product pom url http://hc.apache.org/httpcomponents-client Medium Version file version 4.5.1 High Version Manifest Implementation-Version 4.5.1 High Version pom version 4.5.1 Highest
File Path: /root/.m2/repository/org/apache/ivy/ivy/2.4.0/ivy-2.4.0.jarMD5: 8c88b943fcd643d5e592b86179c6fbebSHA1: 5abe4c24bbe992a9ac07ca563d5bd3e8d569e9edSHA256: ce81cb234406b093b5b8de9f6f5b2a50ed0824d6a235891353e8d3e941a53970Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name ivy High Vendor jar package name apache Highest Vendor jar package name ivy Highest Vendor Manifest bundle-docurl http://ant.apache.org/ivy/ Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname org.apache.ivy Medium Vendor Manifest extension-name org.apache.ivy Medium Vendor Manifest Implementation-Vendor Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor Apache Software Foundation Low Vendor pom artifactid ivy Highest Vendor pom artifactid ivy Low Vendor pom groupid org.apache.ivy Highest Vendor pom name Apache Ivy High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://ant.apache.org/ivy/ Highest Product file name ivy High Product jar package name ant Highest Product jar package name apache Highest Product jar package name ivy Highest Product Manifest bundle-docurl http://ant.apache.org/ivy/ Low Product Manifest Bundle-Name Ivy Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname org.apache.ivy Medium Product Manifest extension-name org.apache.ivy Medium Product Manifest Implementation-Title org.apache.ivy High Product Manifest specification-title Apache Ivy with Ant tasks Medium Product pom artifactid ivy Highest Product pom groupid org.apache.ivy Highest Product pom name Apache Ivy High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://ant.apache.org/ivy/ Medium Version file version 2.4.0 High Version Manifest build-version 2.4.0 Medium Version Manifest Implementation-Version 2.4.0 High Version pom parent-version 2.4.0 Low Version pom version 2.4.0 Highest
CVE-2022-37865 suppress
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2022-37866 suppress
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
Description:
Core Jackson processing abstractions (aka Streaming API), implementation for JSON License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.12.7/jackson-core-2.12.7.jar
MD5: e90114f7c87c241568606cc9e2c61cb1
SHA1: 04669a54b799c105572aa8de2a1ae0fe64a17745
SHA256: 3987a6a335046e226e56b81d69668fb5a91b155ea7fd96b0851adbb7d4ac1ca6
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-repl_2.11:provided livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name jackson-core High Vendor jar package name base Highest Vendor jar package name core Highest Vendor jar package name fasterxml Highest Vendor jar package name jackson Highest Vendor jar package name json Highest Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest bundle-docurl https://github.com/FasterXML/jackson-core Low Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Vendor Manifest implementation-build-date 2022-05-26 17:27:52+0000 Low Vendor Manifest Implementation-Vendor FasterXML High Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor FasterXML Low Vendor pom artifactid jackson-core Highest Vendor pom artifactid jackson-core Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom name Jackson-core High Vendor pom parent-artifactid jackson-base Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom url FasterXML/jackson-core Highest Product file name jackson-core High Product hint analyzer product java8 Highest Product hint analyzer product modules Highest Product jar package name base Highest Product jar package name core Highest Product jar package name fasterxml Highest Product jar package name filter Highest Product jar package name jackson Highest Product jar package name json Highest Product jar package name version Highest Product Manifest build-jdk-spec 1.8 Low Product Manifest bundle-docurl https://github.com/FasterXML/jackson-core Low Product Manifest Bundle-Name Jackson-core Medium Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Product Manifest implementation-build-date 2022-05-26 17:27:52+0000 Low Product Manifest Implementation-Title Jackson-core High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest specification-title Jackson-core Medium Product pom artifactid jackson-core Highest Product pom groupid com.fasterxml.jackson.core Highest Product pom name Jackson-core High Product pom parent-artifactid jackson-base Medium Product pom parent-groupid com.fasterxml.jackson Medium Product pom url FasterXML/jackson-core High Version file version 2.12.7 High Version Manifest Bundle-Version 2.12.7 High Version Manifest Implementation-Version 2.12.7 High Version pom version 2.12.7 Highest
Related Dependencies jackson-annotations-2.12.7.jarFile Path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.12.7/jackson-annotations-2.12.7.jar MD5: a9f4e4700f6670614028753302a995ed SHA1: 2042461b754cd65ab2dd74a9f19f442b54625f19 SHA256: 3cacef714a89f3d68b69fa11263afa55a6aa2fdef1fff93ded22caa16b54687c pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.12.7 Description:
Jackson is a high-performance JSON processor (parser, generator)
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-core-asl/1.9.13/jackson-core-asl-1.9.13.jar
MD5: 319c49a4304e3fa9fe3cd8dcfc009d37
SHA1: 3c304d70f42f832e0a86d45bd437f692129299a4
SHA256: 440a9cb5ca95b215f953d3a20a6b1a10da1f09b529a9ddea5f8a4905ddab4f5a
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jackson-core-asl High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-core-asl Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor Manifest specification-vendor http://www.ietf.org/rfc/rfc4627.txt Low Vendor pom artifactid jackson-core-asl Highest Vendor pom artifactid jackson-core-asl Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id cowtowncoder Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid org.codehaus.jackson Highest Vendor pom name Jackson High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-core-asl High Product jar package name codehaus Highest Product jar package name jackson Highest Product Manifest Bundle-Name Jackson JSON processor Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-core-asl Medium Product Manifest Implementation-Title Jackson JSON processor High Product Manifest specification-title JSON - JavaScript Object Notation Medium Product pom artifactid jackson-core-asl Highest Product pom developer email tatu@fasterxml.com Low Product pom developer id cowtowncoder Low Product pom developer name Tatu Saloranta Low Product pom groupid org.codehaus.jackson Highest Product pom name Jackson High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.9.13 High Version Manifest Bundle-Version 1.9.13 High Version Manifest Implementation-Version 1.9.13 High Version pom version 1.9.13 Highest
Description:
General data-binding functionality for Jackson: works on core streaming API License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.12.7.1/jackson-databind-2.12.7.1.jar
MD5: 5c2dab5ceb80bddf3350ecc90bd99314
SHA1: 48d6674adb5a077f2c04b42795e2e7624997b8b9
SHA256: 3f504cac405ce066d5665ff69541484d5322f35ac7a7ec6104cf86a01008e02d
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-repl_2.11:provided livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name jackson-databind High Vendor jar package name databind Highest Vendor jar package name fasterxml Highest Vendor jar package name jackson Highest Vendor Manifest build-jdk-spec 11 Low Vendor Manifest bundle-docurl http://github.com/FasterXML/jackson Low Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Vendor Manifest implementation-build-date 2022-10-13 03:36:18+0000 Low Vendor Manifest Implementation-Vendor FasterXML High Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor Manifest specification-vendor FasterXML Low Vendor pom artifactid jackson-databind Highest Vendor pom artifactid jackson-databind Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom name jackson-databind High Vendor pom parent-artifactid jackson-base Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom url http://github.com/FasterXML/jackson Highest Product file name jackson-databind High Product hint analyzer product java8 Highest Product hint analyzer product modules Highest Product jar package name databind Highest Product jar package name fasterxml Highest Product jar package name jackson Highest Product Manifest build-jdk-spec 11 Low Product Manifest bundle-docurl http://github.com/FasterXML/jackson Low Product Manifest Bundle-Name jackson-databind Medium Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Product Manifest implementation-build-date 2022-10-13 03:36:18+0000 Low Product Manifest Implementation-Title jackson-databind High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title jackson-databind Medium Product pom artifactid jackson-databind Highest Product pom groupid com.fasterxml.jackson.core Highest Product pom name jackson-databind High Product pom parent-artifactid jackson-base Medium Product pom parent-groupid com.fasterxml.jackson Medium Product pom url http://github.com/FasterXML/jackson Medium Version file version 2.12.7.1 High Version Manifest Bundle-Version 2.12.7.1 High Version Manifest Implementation-Version 2.12.7.1 High Version pom parent-version 2.12.7.1 Low Version pom version 2.12.7.1 Highest
Description:
Jax-RS provider for JSON content type, based on
Jackson JSON processor's data binding functionality.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
GNU Lesser General Public License (LGPL), Version 2.1: http://www.fsf.org/licensing/licenses/lgpl.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-jaxrs/1.8.3/jackson-jaxrs-1.8.3.jar
MD5: 7634227657d2414a0c65e0818b30d5ed
SHA1: 3604ca9f572170e2ef5813141ec1f0e0100efd19
SHA256: cadd12137aaf121722630d00117df63e34afc5b3dab5be68c921740114a05fba
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jackson-jaxrs High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor jar package name jaxrs Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-jaxrs Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor pom artifactid jackson-jaxrs Highest Vendor pom artifactid jackson-jaxrs Low Vendor pom groupid org.codehaus.jackson Highest Vendor pom name JAX-RS provider for JSON content type High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-jaxrs High Product jar package name codehaus Highest Product jar package name jackson Highest Product jar package name jaxrs Highest Product Manifest Bundle-Name JAX-RS provider for JSON content type, using Jackson data binding Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-jaxrs Medium Product Manifest Implementation-Title JAX-RS provider for JSON content type, using Jackson data binding High Product pom artifactid jackson-jaxrs Highest Product pom groupid org.codehaus.jackson Highest Product pom name JAX-RS provider for JSON content type High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.8.3 High Version Manifest Bundle-Version 1.8.3 High Version Manifest Implementation-Version 1.8.3 High Version pom version 1.8.3 Highest
Description:
Jax-RS provider for JSON content type, based on
Jackson JSON processor's data binding functionality.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
GNU Lesser General Public License (LGPL), Version 2.1: http://www.fsf.org/licensing/licenses/lgpl.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-jaxrs/1.9.13/jackson-jaxrs-1.9.13.jar
MD5: 8481e1904d9bfe974157a6af04b4445e
SHA1: 534d72d2b9d6199dd531dfb27083dd4844082bba
SHA256: 1770570a6ba5c87a4795c0aeb40ee7c5fe5e31df64ef1d4795a0d427796b84bb
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jackson-jaxrs High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor jar package name jaxrs Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-jaxrs Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor pom artifactid jackson-jaxrs Highest Vendor pom artifactid jackson-jaxrs Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id cowtowncoder Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid org.codehaus.jackson Highest Vendor pom name JAX-RS provider for JSON content type High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-jaxrs High Product jar package name codehaus Highest Product jar package name jackson Highest Product jar package name jaxrs Highest Product Manifest Bundle-Name JAX-RS provider for JSON content type, using Jackson data binding Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-jaxrs Medium Product Manifest Implementation-Title JAX-RS provider for JSON content type, using Jackson data binding High Product pom artifactid jackson-jaxrs Highest Product pom developer email tatu@fasterxml.com Low Product pom developer id cowtowncoder Low Product pom developer name Tatu Saloranta Low Product pom groupid org.codehaus.jackson Highest Product pom name JAX-RS provider for JSON content type High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.9.13 High Version Manifest Bundle-Version 1.9.13 High Version Manifest Implementation-Version 1.9.13 High Version pom version 1.9.13 Highest
Description:
Data Mapper package is a high-performance data binding package
built on Jackson JSON processor
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar
MD5: 1750f9c339352fc4b728d61b57171613
SHA1: 1ee2f2bed0e5dd29d1cb155a166e6f8d50bbddb7
SHA256: 74e7a07a76f2edbade29312a5a2ebccfa019128bc021ece3856d76197e9be0c2
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jackson-mapper-asl High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-mapper-asl Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor pom artifactid jackson-mapper-asl Highest Vendor pom artifactid jackson-mapper-asl Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id cowtowncoder Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid org.codehaus.jackson Highest Vendor pom name Data Mapper for Jackson High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-mapper-asl High Product jar package name codehaus Highest Product jar package name jackson Highest Product Manifest Bundle-Name Data mapper for Jackson JSON processor Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-mapper-asl Medium Product Manifest Implementation-Title Data mapper for Jackson JSON processor High Product pom artifactid jackson-mapper-asl Highest Product pom developer email tatu@fasterxml.com Low Product pom developer id cowtowncoder Low Product pom developer name Tatu Saloranta Low Product pom groupid org.codehaus.jackson Highest Product pom name Data Mapper for Jackson High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.9.13 High Version Manifest Bundle-Version 1.9.13 High Version Manifest Implementation-Version 1.9.13 High Version pom version 1.9.13 Highest
CVE-2017-7525 (OSSINDEX)suppress
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. CWE-184 Incomplete Blacklist
CVSSv2:
Base Score: HIGH (9.8) Vector: /AV:N/AC:L/Au:/C:H/I:H/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.codehaus.jackson:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:* CVE-2019-10172 suppress
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes. CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
Description:
jackson-module-scala License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/fasterxml/jackson/module/jackson-module-scala_2.11/2.12.7/jackson-module-scala_2.11-2.12.7.jar
MD5: b2e032982da8847749193c918d377bed
SHA1: 130d9cc561cf5b4610df8a05251ba47dd996cea4
SHA256: a1b399b25a9edc90c9eb800b230bb9782b3ad111e5c8ee20a0b6d876e2992602
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jackson-module-scala_2.11-2.12.7 High Vendor jar package name fasterxml Highest Vendor jar package name jackson Highest Vendor jar package name module Highest Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname com.fasterxml.jackson.module.jackson.module.scala Medium Vendor Manifest Implementation-Vendor com.fasterxml.jackson.module High Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.module Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest specification-vendor com.fasterxml.jackson.module Low Vendor pom artifactid jackson-module-scala_2.11 Highest Vendor pom artifactid jackson-module-scala_2.11 Low Vendor pom developer email christopher@currie.com Low Vendor pom developer email mbk@kjetland.com Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id christopher Medium Vendor pom developer id mbknor Medium Vendor pom developer id tatu Medium Vendor pom developer name Christopher Currie Medium Vendor pom developer name Morten Kjetland Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid com.fasterxml.jackson.module Highest Vendor pom name jackson-module-scala High Vendor pom organization name com.fasterxml.jackson.module High Vendor pom url http://wiki.fasterxml.com/JacksonModuleScala Highest Product file name jackson-module-scala_2.11-2.12.7 High Product jar package name fasterxml Highest Product jar package name jackson Highest Product jar package name module Highest Product jar package name scala Highest Product Manifest Bundle-Name jackson-module-scala Medium Product Manifest bundle-symbolicname com.fasterxml.jackson.module.jackson.module.scala Medium Product Manifest Implementation-Title jackson-module-scala High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest specification-title jackson-module-scala Medium Product pom artifactid jackson-module-scala_2.11 Highest Product pom developer email christopher@currie.com Low Product pom developer email mbk@kjetland.com Low Product pom developer email tatu@fasterxml.com Low Product pom developer id christopher Low Product pom developer id mbknor Low Product pom developer id tatu Low Product pom developer name Christopher Currie Low Product pom developer name Morten Kjetland Low Product pom developer name Tatu Saloranta Low Product pom groupid com.fasterxml.jackson.module Highest Product pom name jackson-module-scala High Product pom organization name com.fasterxml.jackson.module Low Product pom url http://wiki.fasterxml.com/JacksonModuleScala Medium Version Manifest Bundle-Version 2.12.7 High Version Manifest Implementation-Version 2.12.7 High Version pom version 2.12.7 Highest
Description:
jackson-module-scala License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/fasterxml/jackson/module/jackson-module-scala_2.12/2.12.7/jackson-module-scala_2.12-2.12.7.jar
MD5: 76da25a3c493e4437f1fdcd225e17db7
SHA1: 36b89491441afff9cbd98e0b59359db5fbb58dbd
SHA256: e2426ee1d150f85eaceeca19dc50d3eeb80ead221c9574651af4997b7359bef1
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-repl_2.12:provided Evidence Type Source Name Value Confidence Vendor file name jackson-module-scala_2.12-2.12.7 High Vendor jar package name fasterxml Highest Vendor jar package name jackson Highest Vendor jar package name module Highest Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname com.fasterxml.jackson.module.jackson.module.scala Medium Vendor Manifest Implementation-Vendor com.fasterxml.jackson.module High Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.module Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest specification-vendor com.fasterxml.jackson.module Low Vendor pom artifactid jackson-module-scala_2.12 Highest Vendor pom artifactid jackson-module-scala_2.12 Low Vendor pom developer email christopher@currie.com Low Vendor pom developer email mbk@kjetland.com Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id christopher Medium Vendor pom developer id mbknor Medium Vendor pom developer id tatu Medium Vendor pom developer name Christopher Currie Medium Vendor pom developer name Morten Kjetland Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid com.fasterxml.jackson.module Highest Vendor pom name jackson-module-scala High Vendor pom organization name com.fasterxml.jackson.module High Vendor pom url http://wiki.fasterxml.com/JacksonModuleScala Highest Product file name jackson-module-scala_2.12-2.12.7 High Product jar package name fasterxml Highest Product jar package name jackson Highest Product jar package name module Highest Product jar package name scala Highest Product Manifest Bundle-Name jackson-module-scala Medium Product Manifest bundle-symbolicname com.fasterxml.jackson.module.jackson.module.scala Medium Product Manifest Implementation-Title jackson-module-scala High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest specification-title jackson-module-scala Medium Product pom artifactid jackson-module-scala_2.12 Highest Product pom developer email christopher@currie.com Low Product pom developer email mbk@kjetland.com Low Product pom developer email tatu@fasterxml.com Low Product pom developer id christopher Low Product pom developer id mbknor Low Product pom developer id tatu Low Product pom developer name Christopher Currie Low Product pom developer name Morten Kjetland Low Product pom developer name Tatu Saloranta Low Product pom groupid com.fasterxml.jackson.module Highest Product pom name jackson-module-scala High Product pom organization name com.fasterxml.jackson.module Low Product pom url http://wiki.fasterxml.com/JacksonModuleScala Medium Version Manifest Bundle-Version 2.12.7 High Version Manifest Implementation-Version 2.12.7 High Version pom version 2.12.7 Highest
Description:
Extensions that provide interoperability support for
Jackson JSON processor's data binding functionality.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
GNU Lesser General Public License (LGPL), Version 2.1: http://www.fsf.org/licensing/licenses/lgpl.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-xc/1.8.3/jackson-xc-1.8.3.jar
MD5: 0ee32b08580654d69147ecfab0321270
SHA1: 1226667dcdb7c259b3ee07e112ed83446554516e
SHA256: e25789f6d6e0c60c0f46f89d33586190bef23626d9efd3b5d41fe42b45afec96
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jackson-xc High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor jar package name xc Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-xc Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor pom artifactid jackson-xc Highest Vendor pom artifactid jackson-xc Low Vendor pom groupid org.codehaus.jackson Highest Vendor pom name Xml Compatibility extensions for Jackson High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-xc High Product jar package name codehaus Highest Product jar package name jackson Highest Product jar package name xc Highest Product Manifest Bundle-Name XML Compatibility extensions for Jackson data binding Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-xc Medium Product Manifest Implementation-Title XML Compatibility extensions for Jackson data binding High Product pom artifactid jackson-xc Highest Product pom groupid org.codehaus.jackson Highest Product pom name Xml Compatibility extensions for Jackson High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.8.3 High Version Manifest Bundle-Version 1.8.3 High Version Manifest Implementation-Version 1.8.3 High Version pom version 1.8.3 Highest
CVE-2018-7489 suppress
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. CWE-502 Deserialization of Untrusted Data, CWE-184 Incomplete Blacklist
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-36518 suppress
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CWE-787 Out-of-bounds Write
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42003 suppress
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1 CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42004 suppress
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Extensions that provide interoperability support for
Jackson JSON processor's data binding functionality.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
GNU Lesser General Public License (LGPL), Version 2.1: http://www.fsf.org/licensing/licenses/lgpl.txt File Path: /root/.m2/repository/org/codehaus/jackson/jackson-xc/1.9.13/jackson-xc-1.9.13.jar
MD5: 49f6a735bae30745dcf5ecec27090720
SHA1: e3480072bc95c202476ffa1de99ff7ee9149f29c
SHA256: 2d2905fcec7d1c55b775995617685dbb03672350704d9e40b492eab5b54d0be7
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jackson-xc High Vendor jar package name codehaus Highest Vendor jar package name jackson Highest Vendor jar package name xc Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Vendor Manifest bundle-symbolicname jackson-xc Medium Vendor Manifest Implementation-Vendor http://fasterxml.com High Vendor pom artifactid jackson-xc Highest Vendor pom artifactid jackson-xc Low Vendor pom developer email tatu@fasterxml.com Low Vendor pom developer id cowtowncoder Medium Vendor pom developer name Tatu Saloranta Medium Vendor pom groupid org.codehaus.jackson Highest Vendor pom name Xml Compatibility extensions for Jackson High Vendor pom organization name FasterXML High Vendor pom organization url http://fasterxml.com Medium Vendor pom url http://jackson.codehaus.org Highest Product file name jackson-xc High Product jar package name codehaus Highest Product jar package name jackson Highest Product jar package name xc Highest Product Manifest Bundle-Name XML Compatibility extensions for Jackson data binding Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low Product Manifest bundle-symbolicname jackson-xc Medium Product Manifest Implementation-Title XML Compatibility extensions for Jackson data binding High Product pom artifactid jackson-xc Highest Product pom developer email tatu@fasterxml.com Low Product pom developer id cowtowncoder Low Product pom developer name Tatu Saloranta Low Product pom groupid org.codehaus.jackson Highest Product pom name Xml Compatibility extensions for Jackson High Product pom organization name FasterXML Low Product pom organization url http://fasterxml.com Low Product pom url http://jackson.codehaus.org Medium Version file version 1.9.13 High Version Manifest Bundle-Version 1.9.13 High Version Manifest Implementation-Version 1.9.13 High Version pom version 1.9.13 Highest
CVE-2018-7489 suppress
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. CWE-502 Deserialization of Untrusted Data, CWE-184 Incomplete Blacklist
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-36518 suppress
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CWE-787 Out-of-bounds Write
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42003 suppress
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1 CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-42004 suppress
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
The "JANINO" implementation of the "commons-compiler" API: Super-small, super-fast, independent from the JDK's "tools.jar". License:
https://raw.githubusercontent.com/janino-compiler/janino/master/LICENSE File Path: /root/.m2/repository/org/codehaus/janino/janino/3.0.9/janino-3.0.9.jar
MD5: 4ee85915848cbe3344b21712128cab4a
SHA1: 0ddfd261063f2e6300e4c884aeef5f145dd0b38d
SHA256: 32f17d3be316aa398840fe891136f8a26c2f07c0c53fc2944268c4ba96e3b734
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name janino High Vendor jar package name codehaus Highest Vendor jar package name compiler Highest Vendor jar package name janino Highest Vendor jar package name tools Highest Vendor Manifest bundle-symbolicname org.codehaus.janino.janino;singleton:=true Medium Vendor Manifest require-bundle org.codehaus.janino.commons-compiler Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid janino Highest Vendor pom artifactid janino Low Vendor pom groupid org.codehaus.janino Highest Vendor pom name janino High Vendor pom parent-artifactid janino-parent Low Product file name janino High Product jar package name codehaus Highest Product jar package name compiler Highest Product jar package name janino Highest Product jar package name java Highest Product jar package name tools Highest Product Manifest Bundle-Name janino Medium Product Manifest bundle-symbolicname org.codehaus.janino.janino;singleton:=true Medium Product Manifest require-bundle org.codehaus.janino.commons-compiler Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid janino Highest Product pom groupid org.codehaus.janino Highest Product pom name janino High Product pom parent-artifactid janino-parent Medium Version file version 3.0.9 High Version Manifest Bundle-Version 3.0.9 High Version pom version 3.0.9 Highest
Description:
XML Builder is a utility that creates simple XML documents using relatively sparse Java code License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/com/jamesmurty/utils/java-xmlbuilder/0.4/java-xmlbuilder-0.4.jar
MD5: 0fa474213a6a0282cd9264f6e0dd3658
SHA1: ac5962e48cdee3a0a6e1f8e00fcb594747ac5aaf
SHA256: 681e53c4ffd59fa12068803b259e3a83d43f07a47c112e748a187dee179eb31f
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name java-xmlbuilder High Vendor jar package name base64 Low Vendor jar package name iharder Low Vendor jar package name jamesmurty Highest Vendor jar package name net Low Vendor jar package name utils Highest Vendor jar package name xmlbuilder Highest Vendor pom artifactid java-xmlbuilder Highest Vendor pom artifactid java-xmlbuilder Low Vendor pom developer id jmurty Medium Vendor pom developer name James Murty Medium Vendor pom groupid com.jamesmurty.utils Highest Vendor pom name java-xmlbuilder High Vendor pom url http://code.google.com/p/java-xmlbuilder/ Highest Product file name java-xmlbuilder High Product jar package name base64 Low Product jar package name iharder Low Product jar package name jamesmurty Highest Product jar package name utils Highest Product jar package name xmlbuilder Highest Product pom artifactid java-xmlbuilder Highest Product pom developer id jmurty Low Product pom developer name James Murty Low Product pom groupid com.jamesmurty.utils Highest Product pom name java-xmlbuilder High Product pom url http://code.google.com/p/java-xmlbuilder/ Medium Version file version 0.4 High Version pom version 0.4 Highest
Description:
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation
simple. It is a class library for editing bytecodes in Java.
License:
MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: http://www.apache.org/licenses/ File Path: /root/.m2/repository/org/javassist/javassist/3.18.1-GA/javassist-3.18.1-GA.jar
MD5: 5bb83868c87334320562af7eded65cc2
SHA1: d9a09f7732226af26bf99f19e2cffe0ae219db5b
SHA256: 3fb71231afd098bb0f93f5eb97aa8291c8d0556379125e596f92ec8f944c6162
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name javassist High Vendor jar package name bytecode Highest Vendor jar package name javassist Highest Vendor Manifest bundle-symbolicname javassist Medium Vendor Manifest specification-vendor Shigeru Chiba, www.javassist.org Low Vendor pom artifactid javassist Highest Vendor pom artifactid javassist Low Vendor pom developer email adinn@redhat.com Low Vendor pom developer email chiba@javassist.org Low Vendor pom developer email kabir.khan@jboss.com Low Vendor pom developer email smarlow@redhat.com Low Vendor pom developer id adinn Medium Vendor pom developer id chiba Medium Vendor pom developer id kabir.khan@jboss.com Medium Vendor pom developer id smarlow Medium Vendor pom developer name Andrew Dinn Medium Vendor pom developer name Kabir Khan Medium Vendor pom developer name Scott Marlow Medium Vendor pom developer name Shigeru Chiba Medium Vendor pom developer org JBoss Medium Vendor pom developer org The Javassist Project Medium Vendor pom developer org URL http://www.javassist.org/ Medium Vendor pom developer org URL http://www.jboss.org/ Medium Vendor pom groupid org.javassist Highest Vendor pom name Javassist High Vendor pom url http://www.javassist.org/ Highest Product file name javassist High Product jar package name bytecode Highest Product jar package name javassist Highest Product Manifest Bundle-Name Javassist Medium Product Manifest bundle-symbolicname javassist Medium Product Manifest specification-title Javassist Medium Product pom artifactid javassist Highest Product pom developer email adinn@redhat.com Low Product pom developer email chiba@javassist.org Low Product pom developer email kabir.khan@jboss.com Low Product pom developer email smarlow@redhat.com Low Product pom developer id adinn Low Product pom developer id chiba Low Product pom developer id kabir.khan@jboss.com Low Product pom developer id smarlow Low Product pom developer name Andrew Dinn Low Product pom developer name Kabir Khan Low Product pom developer name Scott Marlow Low Product pom developer name Shigeru Chiba Low Product pom developer org JBoss Low Product pom developer org The Javassist Project Low Product pom developer org URL http://www.javassist.org/ Low Product pom developer org URL http://www.jboss.org/ Low Product pom groupid org.javassist Highest Product pom name Javassist High Product pom url http://www.javassist.org/ Medium Version pom version 3.18.1-GA Highest
Description:
JavaBeans Activation Framework License:
https://github.com/javaee/activation/blob/master/LICENSE.txt File Path: /root/.m2/repository/com/sun/activation/javax.activation/1.2.0/javax.activation-1.2.0.jar
MD5: be7c430df50b330cffc4848a3abedbfb
SHA1: bf744c1e2776ed1de3c55c8dac1057ec331ef744
SHA256: 993302b16cd7056f21e779cc577d175a810bb4900ef73cd8fbf2b50f928ba9ce
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name javax.activation High Vendor jar package name activation Highest Vendor jar package name javax Highest Vendor jar package name sun Highest Vendor jar (hint) package name oracle Highest Vendor Manifest automatic-module-name java.activation Medium Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname com.sun.activation.javax.activation Medium Vendor Manifest extension-name javax.activation Medium Vendor Manifest Implementation-Vendor Oracle High Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest originally-created-by 1.8.0_141 (Oracle Corporation) Low Vendor Manifest specification-vendor Oracle Low Vendor Manifest (hint) Implementation-Vendor sun High Vendor Manifest (hint) specification-vendor sun Low Vendor pom artifactid javax.activation Highest Vendor pom artifactid javax.activation Low Vendor pom groupid com.sun.activation Highest Vendor pom name JavaBeans Activation Framework High Vendor pom parent-artifactid all Low Product file name javax.activation High Product jar package name activation Highest Product jar package name javax Highest Product jar package name sun Highest Product Manifest automatic-module-name java.activation Medium Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name JavaBeans Activation Framework Medium Product Manifest bundle-symbolicname com.sun.activation.javax.activation Medium Product Manifest extension-name javax.activation Medium Product Manifest Implementation-Title javax.activation High Product Manifest originally-created-by 1.8.0_141 (Oracle Corporation) Low Product Manifest specification-title JavaBeans(TM) Activation Framework Specification Medium Product pom artifactid javax.activation Highest Product pom groupid com.sun.activation Highest Product pom name JavaBeans Activation Framework High Product pom parent-artifactid all Medium Version file version 1.2.0 High Version Manifest Bundle-Version 1.2.0 High Version Manifest Implementation-Version 1.2.0 High Version pom version 1.2.0 Highest
Description:
Common Annotations for the JavaTM Platform API License:
CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html File Path: /root/.m2/repository/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.jar
MD5: 75fe320d2b3763bd6883ae1ede35e987
SHA1: 479c1e06db31c432330183f5cae684163f186146
SHA256: 5909b396ca3a2be10d0eea32c74ef78d816e1b4ead21de1d78de1f890d033e04
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name javax.annotation-api High Vendor jar package name annotation Highest Vendor jar package name javax Highest Vendor Manifest bundle-docurl https://glassfish.java.net Low Vendor Manifest bundle-symbolicname javax.annotation-api Medium Vendor Manifest extension-name javax.annotation Medium Vendor Manifest Implementation-Vendor GlassFish Community High Vendor Manifest Implementation-Vendor-Id org.glassfish Medium Vendor Manifest specification-vendor Oracle Corporation Low Vendor pom artifactid javax.annotation-api Highest Vendor pom artifactid javax.annotation-api Low Vendor pom developer id mode Medium Vendor pom developer name Rajiv Mordani Medium Vendor pom developer org Oracle, Inc. Medium Vendor pom groupid javax.annotation Highest Vendor pom name ${extension.name} API High Vendor pom organization name GlassFish Community High Vendor pom organization url https://glassfish.java.net Medium Vendor pom parent-artifactid jvnet-parent Low Vendor pom parent-groupid net.java Medium Vendor pom url http://jcp.org/en/jsr/detail?id=250 Highest Product file name javax.annotation-api High Product jar package name annotation Highest Product jar package name javax Highest Product Manifest bundle-docurl https://glassfish.java.net Low Product Manifest Bundle-Name javax.annotation API Medium Product Manifest bundle-symbolicname javax.annotation-api Medium Product Manifest extension-name javax.annotation Medium Product pom artifactid javax.annotation-api Highest Product pom developer id mode Low Product pom developer name Rajiv Mordani Low Product pom developer org Oracle, Inc. Low Product pom groupid javax.annotation Highest Product pom name ${extension.name} API High Product pom organization name GlassFish Community Low Product pom organization url https://glassfish.java.net Low Product pom parent-artifactid jvnet-parent Medium Product pom parent-groupid net.java Medium Product pom url http://jcp.org/en/jsr/detail?id=250 Medium Version file version 1.2 High Version Manifest Bundle-Version 1.2 High Version Manifest Implementation-Version 1.2 High Version pom parent-version 1.2 Low Version pom version 1.2 Highest
Description:
The javax.inject API License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
SHA256: 91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name javax.inject-1 High Vendor jar package name inject Highest Vendor jar package name inject Low Vendor jar package name javax Highest Vendor jar package name javax Low Vendor pom artifactid javax.inject Highest Vendor pom artifactid javax.inject Low Vendor pom groupid javax.inject Highest Vendor pom name javax.inject High Vendor pom url http://code.google.com/p/atinject/ Highest Product file name javax.inject-1 High Product jar package name inject Highest Product jar package name inject Low Product jar package name javax Highest Product pom artifactid javax.inject Highest Product pom groupid javax.inject Highest Product pom name javax.inject High Product pom url http://code.google.com/p/atinject/ Medium Version file version 1 Medium Version pom version 1 Highest
Description:
Injection API (JSR 330) version ${javax.inject.version} repackaged as OSGi bundle License:
https://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/hk2/external/javax.inject/2.4.0-b34/javax.inject-2.4.0-b34.jar
MD5: 0299609004955f54207ab8562273b5af
SHA1: a6a3d4935af7b03e44126b5aac2c2a0ce98fe6e9
SHA256: fdbf80a01b854045bd4004b7c6b1fdc2da81db475bfbd08ed574eeffcf9a7b1a
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name javax.inject High Vendor jar package name inject Highest Vendor jar package name javax Highest Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.external.javax.inject Medium Vendor pom artifactid javax.inject Highest Vendor pom artifactid javax.inject Low Vendor pom groupid org.glassfish.hk2.external Highest Vendor pom name javax.inject:${javax-inject.version} as OSGi bundle High Vendor pom parent-artifactid external Low Vendor pom parent-groupid org.glassfish.hk2 Medium Product file name javax.inject High Product jar package name inject Highest Product jar package name javax Highest Product Manifest bundle-docurl http://www.oracle.com Low Product Manifest Bundle-Name javax.inject:1 as OSGi bundle Medium Product Manifest bundle-symbolicname org.glassfish.hk2.external.javax.inject Medium Product pom artifactid javax.inject Highest Product pom groupid org.glassfish.hk2.external Highest Product pom name javax.inject:${javax-inject.version} as OSGi bundle High Product pom parent-artifactid external Medium Product pom parent-groupid org.glassfish.hk2 Medium Version pom version 2.4.0-b34 Highest
Description:
Java(TM) Servlet 3.1 API Design Specification License:
CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html File Path: /root/.m2/repository/javax/servlet/javax.servlet-api/3.1.0/javax.servlet-api-3.1.0.jar
MD5: 79de69e9f5ed8c7fcb8342585732bbf7
SHA1: 3cd63d075497751784b2fa84be59432f4905bf7c
SHA256: af456b2dd41c4e82cf54f3e743bc678973d9fe35bd4d3071fa05c7e5333b8482
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name javax.servlet-api High Vendor jar package name javax Highest Vendor jar package name servlet Highest Vendor Manifest bundle-docurl https://glassfish.dev.java.net Low Vendor Manifest bundle-symbolicname javax.servlet-api Medium Vendor Manifest extension-name javax.servlet Medium Vendor Manifest Implementation-Vendor GlassFish Community High Vendor Manifest Implementation-Vendor-Id org.glassfish Medium Vendor Manifest specification-vendor Oracle Corporation Low Vendor pom artifactid javax.servlet-api Highest Vendor pom artifactid javax.servlet-api Low Vendor pom developer id mode Medium Vendor pom developer id swchan2 Medium Vendor pom developer name Rajiv Mordani Medium Vendor pom developer name Shing Wai Chan Medium Vendor pom developer org Oracle Medium Vendor pom groupid javax.servlet Highest Vendor pom name Java Servlet API High Vendor pom organization name GlassFish Community High Vendor pom organization url https://glassfish.dev.java.net Medium Vendor pom parent-artifactid jvnet-parent Low Vendor pom parent-groupid net.java Medium Vendor pom url http://servlet-spec.java.net Highest Vendor pom (hint) developer org sun Medium Product file name javax.servlet-api High Product jar package name javax Highest Product jar package name servlet Highest Product Manifest bundle-docurl https://glassfish.dev.java.net Low Product Manifest Bundle-Name Java Servlet API Medium Product Manifest bundle-symbolicname javax.servlet-api Medium Product Manifest extension-name javax.servlet Medium Product pom artifactid javax.servlet-api Highest Product pom developer id mode Low Product pom developer id swchan2 Low Product pom developer name Rajiv Mordani Low Product pom developer name Shing Wai Chan Low Product pom developer org Oracle Low Product pom groupid javax.servlet Highest Product pom name Java Servlet API High Product pom organization name GlassFish Community Low Product pom organization url https://glassfish.dev.java.net Low Product pom parent-artifactid jvnet-parent Medium Product pom parent-groupid net.java Medium Product pom url http://servlet-spec.java.net Medium Version file version 3.1.0 High Version Manifest Bundle-Version 3.1.0 High Version Manifest Implementation-Version 3.1.0 High Version pom parent-version 3.1.0 Low Version pom version 3.1.0 Highest
Description:
Java API for RESTful Web Services (JAX-RS) License:
CDDL 1.1: http://glassfish.java.net/public/CDDL+GPL_1_1.html
GPL2 w/ CPE: http://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/javax/ws/rs/javax.ws.rs-api/2.0.1/javax.ws.rs-api-2.0.1.jar
MD5: edcd111cf4d3ba8ac8e1f326efc37a17
SHA1: 104e9c2b5583cfcfeac0402316221648d6d8ea6b
SHA256: 38607d626f2288d8fbc1b1f8a62c369e63806d9a313ac7cbc5f9d6c94f4b466d
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name javax.ws.rs-api High Vendor hint analyzer vendor web services Medium Vendor jar package name javax Highest Vendor jar package name rs Highest Vendor jar package name ws Highest Vendor Manifest bundle-docurl http://www.oracle.com/ Low Vendor Manifest bundle-symbolicname javax.ws.rs-api Medium Vendor Manifest extension-name javax.ws.rs Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor Oracle Corporation Low Vendor pom artifactid javax.ws.rs-api Highest Vendor pom artifactid javax.ws.rs-api Low Vendor pom developer email m_potociar@java.net Low Vendor pom developer email spericas@java.net Low Vendor pom developer id Marek Medium Vendor pom developer id Santiago Medium Vendor pom developer name Marek Potociar Medium Vendor pom developer name Santiago Pericas-Geertsen Medium Vendor pom developer org Oracle Medium Vendor pom developer org URL http://jax-rs-spec.java.net Medium Vendor pom groupid javax.ws.rs Highest Vendor pom name javax.ws.rs-api High Vendor pom organization name Oracle Corporation High Vendor pom organization url http://www.oracle.com/ Medium Vendor pom parent-artifactid jvnet-parent Low Vendor pom parent-groupid net.java Medium Vendor pom url http://jax-rs-spec.java.net Highest Vendor pom (hint) developer org sun Medium Product file name javax.ws.rs-api High Product hint analyzer product web services Medium Product jar package name javax Highest Product jar package name rs Highest Product jar package name ws Highest Product Manifest bundle-docurl http://www.oracle.com/ Low Product Manifest Bundle-Name javax.ws.rs-api Medium Product Manifest bundle-symbolicname javax.ws.rs-api Medium Product Manifest extension-name javax.ws.rs Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid javax.ws.rs-api Highest Product pom developer email m_potociar@java.net Low Product pom developer email spericas@java.net Low Product pom developer id Marek Low Product pom developer id Santiago Low Product pom developer name Marek Potociar Low Product pom developer name Santiago Pericas-Geertsen Low Product pom developer org Oracle Low Product pom developer org URL http://jax-rs-spec.java.net Low Product pom groupid javax.ws.rs Highest Product pom name javax.ws.rs-api High Product pom organization name Oracle Corporation Low Product pom organization url http://www.oracle.com/ Low Product pom parent-artifactid jvnet-parent Medium Product pom parent-groupid net.java Medium Product pom url http://jax-rs-spec.java.net Medium Version file version 2.0.1 High Version Manifest Bundle-Version 2.0.1 High Version Manifest Implementation-Version 2.0.1 High Version pom parent-version 2.0.1 Low Version pom version 2.0.1 Highest
Description:
Javolution - Java Solution for Real-Time and Embedded Systems.
This project uses template classes to generates java code for various versions
of the Java run-time (e.g. J2ME, 1.4, GCJ, 1.5). The default maven compilation
builds OSGI bundle for Java 1.5+ (parameterized classes).
For others targets the ant script should be used directly (e.g. "ant j2me").
License:
BSD License: http://javolution.org/LICENSE.txt File Path: /root/.m2/repository/javolution/javolution/5.5.1/javolution-5.5.1.jar
MD5: 1b7257da4690bada3cac7293985f8588
SHA1: 3fcba819cdb7861728405963ddc4b2755ab182e5
SHA256: 6de167427fb5ad34fe533cb36a8b3427fa6052a2b99781874396ed5cca9f8ed1
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name javolution High Vendor jar package name javolution Highest Vendor Manifest bundle-docurl http://javolution.org Low Vendor Manifest bundle-symbolicname javolution Medium Vendor pom artifactid javolution Highest Vendor pom artifactid javolution Low Vendor pom developer email jean-marie@dautelle.com Low Vendor pom developer id dautelle Medium Vendor pom developer name Jean-Marie Dautelle Medium Vendor pom developer org Thales Medium Vendor pom developer org URL http://www.thalesraytheon-fr.com Medium Vendor pom groupid javolution Highest Vendor pom name Javolution High Vendor pom organization name Javolution High Vendor pom organization url http://javolution.org Medium Vendor pom url http://javolution.org Highest Product file name javolution High Product jar package name javolution Highest Product Manifest bundle-docurl http://javolution.org Low Product Manifest Bundle-Name Javolution Medium Product Manifest bundle-symbolicname javolution Medium Product pom artifactid javolution Highest Product pom developer email jean-marie@dautelle.com Low Product pom developer id dautelle Low Product pom developer name Jean-Marie Dautelle Low Product pom developer org Thales Low Product pom developer org URL http://www.thalesraytheon-fr.com Low Product pom groupid javolution Highest Product pom name Javolution High Product pom organization name Javolution Low Product pom organization url http://javolution.org Low Product pom url http://javolution.org Medium Version file version 5.5.1 High Version Manifest Bundle-Version 5.5.1 High Version pom version 5.5.1 Highest
Description:
JAXB (JSR 222) API
License:
CDDL 1.1: https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
GPL2 w/ CPE: https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/javax/xml/bind/jaxb-api/2.2.2/jaxb-api-2.2.2.jar
MD5: a415e9a322984be1e1f8a023d09dca5f
SHA1: aeb3021ca93dde265796d82015beecdcff95bf09
SHA256: 30233df6215fb982d8784de91d307596748cea98d6d502293c7c3e85c1697137
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name jaxb-api High Vendor jar package name bind Highest Vendor jar package name javax Highest Vendor jar package name jaxb Highest Vendor jar package name xml Highest Vendor Manifest extension-name javax.xml.bind Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom artifactid jaxb-api Highest Vendor pom artifactid jaxb-api Low Vendor pom developer name Martin Grebac Medium Vendor pom groupid javax.xml.bind Highest Vendor pom name JAXB API bundle for GlassFish V3 High Vendor pom organization name Oracle Corporation High Vendor pom organization url http://www.oracle.com/ Medium Vendor pom url https://jaxb.dev.java.net/ Highest Product file name jaxb-api High Product jar package name bind Highest Product jar package name javax Highest Product jar package name jaxb Highest Product jar package name xml Highest Product Manifest extension-name javax.xml.bind Medium Product Manifest specification-title Java Architecture for XML Binding Medium Product pom artifactid jaxb-api Highest Product pom developer name Martin Grebac Low Product pom groupid javax.xml.bind Highest Product pom name JAXB API bundle for GlassFish V3 High Product pom organization name Oracle Corporation Low Product pom organization url http://www.oracle.com/ Low Product pom url https://jaxb.dev.java.net/ Medium Version file version 2.2.2 High Version Manifest specification-version 2.2.2 High Version pom version 2.2.2 Highest
Description:
JAXB (JSR 222) reference implementation License:
CDDL 1.1: https://glassfish.java.net/public/CDDL+GPL_1_1.html
GPL2 w/ CPE: https://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/com/sun/xml/bind/jaxb-impl/2.2.3-1/jaxb-impl-2.2.3-1.jar
MD5: 1b689e7f87caf2615c0f6a47831d0342
SHA1: 56baae106392040a45a06d4a41099173425da1e6
SHA256: fa3e1499b192c310312bf02881274b68394aaea4c9563e6c554cc406ae644ff8
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jaxb-impl High Vendor jar package name bind Highest Vendor jar package name sun Highest Vendor jar package name xml Highest Vendor jar (hint) package name oracle Highest Vendor Manifest extension-name com.sun.xml.bind Medium Vendor Manifest Implementation-Vendor Oracle Corporation High Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest specification-vendor Oracle Corporation Low Vendor pom artifactid jaxb-impl Highest Vendor pom artifactid jaxb-impl Low Vendor pom groupid com.sun.xml.bind Highest Vendor pom name JAXB RI High Vendor pom organization name Oracle Corporation High Vendor pom organization url http://www.oracle.com/ Medium Vendor pom url http://jaxb.java.net/ Highest Product file name jaxb-impl High Product jar package name bind Highest Product jar package name sun Highest Product jar package name xml Highest Product Manifest extension-name com.sun.xml.bind Medium Product Manifest Implementation-Title JAXB Reference Implementation High Product Manifest specification-title Java Architecture for XML Binding Medium Product pom artifactid jaxb-impl Highest Product pom groupid com.sun.xml.bind Highest Product pom name JAXB RI High Product pom organization name Oracle Corporation Low Product pom organization url http://www.oracle.com/ Low Product pom url http://jaxb.java.net/ Medium Version pom version 2.2.3-1 Highest
Description:
JCL 1.1.1 implemented over SLF4J File Path: /root/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.16/jcl-over-slf4j-1.7.16.jarMD5: aeb458dc10a619bd32ebc9d399dd64a8SHA1: 034e48073884704ac987d3d1a1ab9b60e62028a9SHA256: 764d8698e00c08dfbd8f6426ed95619cbf5473327a2a7d3b6bea6b1d987c6547Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jcl-over-slf4j High Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname jcl.over.slf4j Medium Vendor pom artifactid jcl-over-slf4j Highest Vendor pom artifactid jcl-over-slf4j Low Vendor pom groupid org.slf4j Highest Vendor pom name JCL 1.1.1 implemented over SLF4J High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name jcl-over-slf4j High Product Manifest Bundle-Name jcl-over-slf4j Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname jcl.over.slf4j Medium Product Manifest Implementation-Title jcl-over-slf4j High Product pom artifactid jcl-over-slf4j Highest Product pom groupid org.slf4j Highest Product pom name JCL 1.1.1 implemented over SLF4J High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.16 High Version Manifest Bundle-Version 1.7.16 High Version Manifest Implementation-Version 1.7.16 High Version pom version 1.7.16 Highest
Description:
The Java Data Objects (JDO) API is a standard interface-based Java model abstraction of persistence, developed as Java Specification Request 243 under the auspices of the Java Community Process. License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/javax/jdo/jdo-api/3.0.1/jdo-api-3.0.1.jar
MD5: 978ae9726514457b8cfe8a3ba1c17ca5
SHA1: 058e7a538e020b73871e232eeb064835fd98a492
SHA256: 2a2e63d44a4d7fe267650d08431218648adee14f725df3896d09db3084d7a2f2
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jdo-api High Vendor jar package name javax Highest Vendor jar package name jdo Highest Vendor Manifest bundle-symbolicname javax.jdo Medium Vendor Manifest Implementation-Vendor Apache Software Foundation High Vendor manifest: javax/jdo Implementation-Vendor Apache Software Foundation Medium Vendor pom artifactid jdo-api Highest Vendor pom artifactid jdo-api Low Vendor pom developer email brianm@apache.org Low Vendor pom developer email Craig.Russell@Sun.COM Low Vendor pom developer email erik@jpox.org Low Vendor pom developer email geirm@apache.org Low Vendor pom developer email martin.zaun@Sun.COM Low Vendor pom developer email matthew@matthewadams.me Low Vendor pom developer email mbo.tech@spree.de Low Vendor pom developer email Michelle.Caisse@Sun.COM Low Vendor pom developer email mwa.tech@spree.de Low Vendor pom developer id brazil Medium Vendor pom developer id brianm Medium Vendor pom developer id clr Medium Vendor pom developer id ebengtson Medium Vendor pom developer id geirm Medium Vendor pom developer id madams Medium Vendor pom developer id mbo Medium Vendor pom developer id mcaisse Medium Vendor pom developer id mzaun Medium Vendor pom developer name Brian McCallister Medium Vendor pom developer name Craig Russell Medium Vendor pom developer name Erik Bengtson Medium Vendor pom developer name Geir Magnusson, Jr. Medium Vendor pom developer name Martin Zaun Medium Vendor pom developer name Matthew Adams Medium Vendor pom developer name Michael Bouschen Medium Vendor pom developer name Michael Watzek Medium Vendor pom developer name Michelle Caisse Medium Vendor pom developer org Apache.org Medium Vendor pom developer org JPOX Medium Vendor pom developer org Sun Microsystems, Inc. Medium Vendor pom developer org Tech@Spree Engineering GmbH Medium Vendor pom groupid javax.jdo Highest Vendor pom name JDO API High Vendor pom organization name Apache Software Foundation High Vendor pom organization url http://www.apache.org Medium Vendor pom url http://db.apache.org/jdo Highest Product file name jdo-api High Product jar package name javax Highest Product jar package name jdo Highest Product Manifest Bundle-Name Java Data Objects Medium Product Manifest bundle-symbolicname javax.jdo Medium Product Manifest Implementation-Title javax.jdo High Product Manifest specification-title Java Data Objects Medium Product manifest: javax/jdo Implementation-Title javax.jdo Medium Product manifest: javax/jdo Specification-Title Java Data Objects (JDO) API Medium Product pom artifactid jdo-api Highest Product pom developer email brianm@apache.org Low Product pom developer email Craig.Russell@Sun.COM Low Product pom developer email erik@jpox.org Low Product pom developer email geirm@apache.org Low Product pom developer email martin.zaun@Sun.COM Low Product pom developer email matthew@matthewadams.me Low Product pom developer email mbo.tech@spree.de Low Product pom developer email Michelle.Caisse@Sun.COM Low Product pom developer email mwa.tech@spree.de Low Product pom developer id brazil Low Product pom developer id brianm Low Product pom developer id clr Low Product pom developer id ebengtson Low Product pom developer id geirm Low Product pom developer id madams Low Product pom developer id mbo Low Product pom developer id mcaisse Low Product pom developer id mzaun Low Product pom developer name Brian McCallister Low Product pom developer name Craig Russell Low Product pom developer name Erik Bengtson Low Product pom developer name Geir Magnusson, Jr. Low Product pom developer name Martin Zaun Low Product pom developer name Matthew Adams Low Product pom developer name Michael Bouschen Low Product pom developer name Michael Watzek Low Product pom developer name Michelle Caisse Low Product pom developer org Apache.org Low Product pom developer org JPOX Low Product pom developer org Sun Microsystems, Inc. Low Product pom developer org Tech@Spree Engineering GmbH Low Product pom groupid javax.jdo Highest Product pom name JDO API High Product pom organization name Apache Software Foundation Low Product pom organization url http://www.apache.org Low Product pom url http://db.apache.org/jdo Medium Version file version 3.0.1 High Version Manifest Bundle-Version 3.0.1 High Version Manifest Implementation-Version 3.0.1 High Version manifest: javax/jdo Implementation-Version 3.0.1 Medium Version pom version 3.0.1 Highest
Description:
Jersey core common packages License:
http://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/jersey/core/jersey-common/2.22.2/jersey-common-2.22.2.jar
MD5: d855b5f16119a933768c13690c099375
SHA1: 1209b89878b60ce7d49afadeff7522d2fde0e217
SHA256: 33c51bda7fe94c27056af05c6b6bb1a0c2968b5bcf09b4c098ccbe953231186d
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jersey-common High Vendor jar package name glassfish Highest Vendor jar package name jersey Highest Vendor Manifest bundle-docurl http://www.oracle.com/ Low Vendor Manifest bundle-symbolicname org.glassfish.jersey.core.jersey-common Medium Vendor pom artifactid jersey-common Highest Vendor pom artifactid jersey-common Low Vendor pom groupid org.glassfish.jersey.core Highest Vendor pom name jersey-core-common High Vendor pom parent-artifactid project Low Vendor pom parent-groupid org.glassfish.jersey Medium Product file name jersey-common High Product jar package name glassfish Highest Product jar package name jersey Highest Product Manifest bundle-docurl http://www.oracle.com/ Low Product Manifest Bundle-Name jersey-core-common Medium Product Manifest bundle-symbolicname org.glassfish.jersey.core.jersey-common Medium Product pom artifactid jersey-common Highest Product pom groupid org.glassfish.jersey.core Highest Product pom name jersey-core-common High Product pom parent-artifactid project Medium Product pom parent-groupid org.glassfish.jersey Medium Version file version 2.22.2 High Version Manifest Bundle-Version 2.22.2 High Version pom version 2.22.2 Highest
CVE-2021-28168 (OSSINDEX)suppress
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: MEDIUM (5.5) Vector: /AV:L/AC:L/Au:/C:H/I:N/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.glassfish.jersey.core:jersey-common:2.22.2:*:*:*:*:*:*:* Description:
Jersey is the open source (under dual CDDL+GPL license) JAX-RS (JSR 311) production quality Reference Implementation for building RESTful Web services. License:
http://glassfish.java.net/public/CDDL+GPL_1_1.html, http://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/com/sun/jersey/jersey-core/1.9/jersey-core-1.9.jar
MD5: 73d196595f5e410a37c0a4337350ceb7
SHA1: 8341846f18187013bb9e27e46b7ee00a6395daf4
SHA256: 2c6d0ec88fc8c36cb41637d9c00d0698c22cb6b6a137fa526ef782e00d2265bc
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jersey-core High Vendor jar package name core Highest Vendor jar package name jersey Highest Vendor jar package name sun Highest Vendor jar (hint) package name oracle Highest Vendor Manifest bundle-docurl http://www.oracle.com/ Low Vendor Manifest bundle-symbolicname com.sun.jersey.jersey-core Medium Vendor Manifest Implementation-Vendor Oracle Corporation High Vendor Manifest Implementation-Vendor-Id com.sun.jersey Medium Vendor pom artifactid jersey-core Highest Vendor pom artifactid jersey-core Low Vendor pom groupid com.sun.jersey Highest Vendor pom name jersey-core High Vendor pom parent-artifactid jersey-project Low Product file name jersey-core High Product jar package name core Highest Product jar package name jersey Highest Product jar package name sun Highest Product Manifest bundle-docurl http://www.oracle.com/ Low Product Manifest Bundle-Name jersey-core Medium Product Manifest bundle-symbolicname com.sun.jersey.jersey-core Medium Product Manifest Implementation-Title jersey-core High Product pom artifactid jersey-core Highest Product pom groupid com.sun.jersey Highest Product pom name jersey-core High Product pom parent-artifactid jersey-project Medium Version file version 1.9 High Version Manifest Bundle-Version 1.9 High Version Manifest Implementation-Version 1.9 High Version pom version 1.9 Highest
CVE-2014-3643 (OSSINDEX)suppress
jersey: XXE via parameter entities not disabled by the jersey SAX parser CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:/C:H/I:N/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:com.sun.jersey:jersey-core:1.9:*:*:*:*:*:*:* Description:
Jersey is the open source (under dual CDDL+GPL license) JAX-RS (JSR 311) production quality Reference Implementation for building RESTful Web services. License:
http://glassfish.java.net/public/CDDL+GPL_1_1.html, http://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/com/sun/jersey/jersey-server/1.9/jersey-server-1.9.jar
MD5: 0c98f6cca5df8197b310a0d1d89bb34a
SHA1: 3a6ea7cc5e15c824953f9f3ece2201b634d90d18
SHA256: 3ded91b198077561bd51f6c0442c9cd70b754d8b31b61afaf448bda9d01848f0
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jersey-server High Vendor jar package name jersey Highest Vendor jar package name server Highest Vendor jar package name sun Highest Vendor jar (hint) package name oracle Highest Vendor Manifest bundle-docurl http://www.oracle.com/ Low Vendor Manifest bundle-symbolicname com.sun.jersey.jersey-server Medium Vendor Manifest Implementation-Vendor Oracle Corporation High Vendor Manifest Implementation-Vendor-Id com.sun.jersey Medium Vendor pom artifactid jersey-server Highest Vendor pom artifactid jersey-server Low Vendor pom groupid com.sun.jersey Highest Vendor pom name jersey-server High Vendor pom parent-artifactid jersey-project Low Product file name jersey-server High Product jar package name jersey Highest Product jar package name server Highest Product jar package name sun Highest Product Manifest bundle-docurl http://www.oracle.com/ Low Product Manifest Bundle-Name jersey-server Medium Product Manifest bundle-symbolicname com.sun.jersey.jersey-server Medium Product Manifest Implementation-Title jersey-server High Product pom artifactid jersey-server Highest Product pom groupid com.sun.jersey Highest Product pom name jersey-server High Product pom parent-artifactid jersey-project Medium Version file version 1.9 High Version Manifest Bundle-Version 1.9 High Version Manifest Implementation-Version 1.9 High Version pom version 1.9 Highest
Related Dependencies jersey-client-1.9.jarFile Path: /root/.m2/repository/com/sun/jersey/jersey-client/1.9/jersey-client-1.9.jar MD5: cdbba85f9cb7ce5e0ca51d610f0228e9 SHA1: d3c4b2b5f89db32c96ceddcb863684821910a7bb SHA256: 8ae03af0d06c46a51b65d123ec40f245da690991aa3669cef4767db8f36fbe68 pkg:maven/com.sun.jersey/jersey-client@1.9 jersey-guice-1.9.jarFile Path: /root/.m2/repository/com/sun/jersey/contribs/jersey-guice/1.9/jersey-guice-1.9.jar MD5: a81140d246f420c1e2eabe649417c5b1 SHA1: 5963c28c47df7e5d6ad34cec80c071c368777f7b SHA256: 544fc92d2625332a9a8eeaa7a7274cf1af6703936a50afa80d92a78200a7de34 pkg:maven/com.sun.jersey.contribs/jersey-guice@1.9 jersey-json-1.9.jarFile Path: /root/.m2/repository/com/sun/jersey/jersey-json/1.9/jersey-json-1.9.jar MD5: 17ca6b0d49ed8db159b7827b6defa6b6 SHA1: 1aa73e1896bcc7013fed247157d7f676226eb432 SHA256: cc5d535f43cef0d1c467240961aae35801a837ab010319e741b2c7a6658f3fd6 pkg:maven/com.sun.jersey/jersey-json@1.9 Description:
Jersey core server implementation License:
http://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /root/.m2/repository/org/glassfish/jersey/core/jersey-server/2.22.2/jersey-server-2.22.2.jar
MD5: 62d36194c28af7a49966554af421488f
SHA1: 5ede3e5f98f8b14d31d1d0fffe9908df2bd41c0f
SHA256: 8f8649b568d068f053362fa3def56206166dfceb3baa74e9f19eff6f8f8d9f1f
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jersey-server High Vendor jar package name glassfish Highest Vendor jar package name jersey Highest Vendor jar package name org Highest Vendor jar package name server Highest Vendor Manifest bundle-docurl http://www.oracle.com/ Low Vendor Manifest bundle-symbolicname org.glassfish.jersey.core.jersey-server Medium Vendor pom artifactid jersey-server Highest Vendor pom artifactid jersey-server Low Vendor pom groupid org.glassfish.jersey.core Highest Vendor pom name jersey-core-server High Vendor pom parent-artifactid project Low Vendor pom parent-groupid org.glassfish.jersey Medium Product file name jersey-server High Product jar package name glassfish Highest Product jar package name jersey Highest Product jar package name org Highest Product jar package name server Highest Product Manifest bundle-docurl http://www.oracle.com/ Low Product Manifest Bundle-Name jersey-core-server Medium Product Manifest bundle-symbolicname org.glassfish.jersey.core.jersey-server Medium Product pom artifactid jersey-server Highest Product pom groupid org.glassfish.jersey.core Highest Product pom name jersey-core-server High Product pom parent-artifactid project Medium Product pom parent-groupid org.glassfish.jersey Medium Version file version 2.22.2 High Version Manifest Bundle-Version 2.22.2 High Version pom version 2.22.2 Highest
Related Dependencies jersey-client-2.22.2.jarFile Path: /root/.m2/repository/org/glassfish/jersey/core/jersey-client/2.22.2/jersey-client-2.22.2.jar MD5: 2954068011b278e9eeb81333325114b3 SHA1: 1712fff037ce5a59e3d67f90fff29222989799ee SHA256: c2229f74968db3d0e676f680a58c1148278def927499f6f2eb1e932aba41fbd5 pkg:maven/org.glassfish.jersey.core/jersey-client@2.22.2 jersey-container-servlet-2.22.2.jar jersey-container-servlet-core-2.22.2.jar jersey-guava-2.22.2.jar jersey-media-jaxb-2.22.2.jarFile Path: /root/.m2/repository/org/glassfish/jersey/media/jersey-media-jaxb/2.22.2/jersey-media-jaxb-2.22.2.jar MD5: 8c868cadfd83b1c7c27a3d7455733293 SHA1: 7a9adf97790a92d09a1f2c027dbd34af15ffee04 SHA256: 0a99789dd4f2f24451f7cf423d5682dbef39a34609555f455b73546967b9c225 pkg:maven/org.glassfish.jersey.media/jersey-media-jaxb@2.22.2 Description:
JetS3t is a free, open-source Java toolkit and application suite for Amazon Simple Storage Service (Amazon S3), Amazon CloudFront content delivery network, and Google Storage for Developers. License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/net/java/dev/jets3t/jets3t/0.9.0/jets3t-0.9.0.jar
MD5: 22559a7c686b19534707228decc3c6d7
SHA1: 792bc96ee7e57b89f472aa0cb5a31015b9f59c96
SHA256: e89893fc754b252af717d7d14accda946f7dfcfc1e293fd3e04725163d661bd7
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jets3t High Vendor jar package name cloudfront Highest Vendor jar package name jets3t Highest Vendor jar package name jets3t Low Vendor jar package name s3 Highest Vendor jar package name service Highest Vendor jar package name service Low Vendor pom artifactid jets3t Highest Vendor pom artifactid jets3t Low Vendor pom groupid net.java.dev.jets3t Highest Vendor pom name An open source Java toolkit for Amazon S3 High Vendor pom url http://www.jets3t.org Highest Product file name jets3t High Product jar package name cloudfront Highest Product jar package name jets3t Highest Product jar package name s3 Highest Product jar package name service Highest Product jar package name service Low Product pom artifactid jets3t Highest Product pom groupid net.java.dev.jets3t Highest Product pom name An open source Java toolkit for Amazon S3 High Product pom url http://www.jets3t.org Medium Version file version 0.9.0 High Version pom version 0.9.0 Highest
Description:
A StAX implementation for JSON. File Path: /root/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jarMD5: fc80e0aabd516c54739262c3d618303aSHA1: 1a01a2a1218fcf9faa2cc2a6ced025bdea687262SHA256: 377940288b0643c48780137f6f68578937e1ea5ca2b73830a820c50a7b7ed801Referenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jettison High Vendor jar package name codehaus Highest Vendor jar package name jettison Highest Vendor jar package name json Highest Vendor Manifest bundle-symbolicname org.codehaus.jettison.jettison Medium Vendor pom artifactid jettison Highest Vendor pom artifactid jettison Low Vendor pom groupid org.codehaus.jettison Highest Vendor pom name Jettison High Product file name jettison High Product jar package name codehaus Highest Product jar package name jettison Highest Product jar package name json Highest Product Manifest Bundle-Name jettison Medium Product Manifest bundle-symbolicname org.codehaus.jettison.jettison Medium Product Manifest Implementation-Title Jettison High Product pom artifactid jettison Highest Product pom groupid org.codehaus.jettison Highest Product pom name Jettison High Version file version 1.1 High Version Manifest Bundle-Version 1.1 High Version Manifest Implementation-Version 1.1 High Version pom version 1.1 Highest
CVE-2022-40149 suppress
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CWE-787 Out-of-bounds Write
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
CVE-2022-40150 suppress
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
Description:
Jetty server core License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php File Path: /root/.m2/repository/org/mortbay/jetty/jetty/6.1.26/jetty-6.1.26.jar
MD5: 12b65438bbaf225102d0396c21236052
SHA1: 2f546e289fddd5b1fab1d4199fbb6e9ef43ee4b0
SHA256: 21091d3a9c1349f640fdc421504a604c040ed89087ecc12afbe32353326ed4e5
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jetty High Vendor jar package name jetty Highest Vendor jar package name mortbay Highest Vendor jar package name server Highest Vendor Manifest bundle-docurl http://jetty.mortbay.org Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.4 Low Vendor Manifest bundle-symbolicname org.mortbay.jetty.server Medium Vendor Manifest mode development Low Vendor Manifest originally-created-by 1.6.0_22 (Sun Microsystems Inc.) Low Vendor Manifest url http://www.eclipse.org/jetty/jetty-parent/project/modules/jetty Low Vendor pom artifactid jetty Highest Vendor pom artifactid jetty Low Vendor pom groupid org.mortbay.jetty Highest Vendor pom name Jetty Server High Vendor pom parent-artifactid project Low Product file name jetty High Product jar package name jetty Highest Product jar package name mortbay Highest Product jar package name server Highest Product Manifest bundle-docurl http://jetty.mortbay.org Low Product Manifest Bundle-Name Jetty Server Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.4 Low Product Manifest bundle-symbolicname org.mortbay.jetty.server Medium Product Manifest mode development Low Product Manifest originally-created-by 1.6.0_22 (Sun Microsystems Inc.) Low Product Manifest url http://www.eclipse.org/jetty/jetty-parent/project/modules/jetty Low Product pom artifactid jetty Highest Product pom groupid org.mortbay.jetty Highest Product pom name Jetty Server High Product pom parent-artifactid project Medium Version file version 6.1.26 High Version Manifest Bundle-Version 6.1.26 High Version Manifest implementation-version 6.1.26 High Version pom version 6.1.26 Highest
Related Dependencies jetty-util-6.1.26.jarFile Path: /root/.m2/repository/org/mortbay/jetty/jetty-util/6.1.26/jetty-util-6.1.26.jar MD5: 450fedce4f7f8ad3761577b10a664200 SHA1: e5642fe0399814e1687d55a3862aa5a3417226a9 SHA256: 9b974ce2b99f48254b76126337dc45b21226f383aaed616f59780adaf167c047 pkg:maven/org.mortbay.jetty/jetty-util@6.1.26 CVE-2011-4461 suppress
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. CWE-310 Cryptographic Issues
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2009-1523 suppress
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
The core jetty server artifact. License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php File Path: /root/.m2/repository/org/eclipse/jetty/jetty-server/9.3.24.v20180605/jetty-server-9.3.24.v20180605.jar
MD5: edb61b344a4b0947328ca4acb5d7f258
SHA1: 0e629740cf0a08b353ec07c35eeab8fd06590041
SHA256: 64f1b63ad2d41cf7b45b53be170706815cd82e9175820dd2cd496d93cd658f62
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name jetty-server High Vendor jar package name eclipse Highest Vendor jar package name jetty Highest Vendor jar package name server Highest Vendor Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Vendor Manifest bundle-docurl http://www.eclipse.org/jetty Low Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Vendor Manifest bundle-symbolicname org.eclipse.jetty.server Medium Vendor Manifest Implementation-Vendor Eclipse.org - Jetty High Vendor Manifest originally-created-by Apache Maven Bundle Plugin Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest url http://www.eclipse.org/jetty Low Vendor pom artifactid jetty-server Highest Vendor pom artifactid jetty-server Low Vendor pom groupid org.eclipse.jetty Highest Vendor pom name Jetty :: Server Core High Vendor pom parent-artifactid jetty-project Low Vendor pom url http://www.eclipse.org/jetty Highest Product file name jetty-server High Product jar package name eclipse Highest Product jar package name jetty Highest Product jar package name server Highest Product Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Product Manifest bundle-docurl http://www.eclipse.org/jetty Low Product Manifest Bundle-Name Jetty :: Server Core Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Product Manifest bundle-symbolicname org.eclipse.jetty.server Medium Product Manifest originally-created-by Apache Maven Bundle Plugin Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest url http://www.eclipse.org/jetty Low Product pom artifactid jetty-server Highest Product pom groupid org.eclipse.jetty Highest Product pom name Jetty :: Server Core High Product pom parent-artifactid jetty-project Medium Product pom url http://www.eclipse.org/jetty Medium Version file version 9.3.24.v20180605 High Version Manifest Bundle-Version 9.3.24.v20180605 High Version Manifest Implementation-Version 9.3.24.v20180605 High Version pom version 9.3.24.v20180605 Highest
Related Dependencies jetty-http-9.3.24.v20180605.jarFile Path: /root/.m2/repository/org/eclipse/jetty/jetty-http/9.3.24.v20180605/jetty-http-9.3.24.v20180605.jar MD5: b4404f125073b071ba7604340534a1eb SHA1: f3d614a7c82b5ee028df78bdb3cdadb6c3be89bc SHA256: 27a7821c47ea86c70a56bf2843b87c81c6c2e5c86ea55e7a675aa8828d432277 pkg:maven/org.eclipse.jetty/jetty-http@9.3.24.v20180605 jetty-io-9.3.24.v20180605.jarFile Path: /root/.m2/repository/org/eclipse/jetty/jetty-io/9.3.24.v20180605/jetty-io-9.3.24.v20180605.jar MD5: edb472508df2e583e75c62b5774a349a SHA1: f12a02ab2cb79eb9c3fa01daf28a58e8ea7cbea9 SHA256: a882194b64b1171b0cdc10f9b2decd2b2023bfd96e2b371218553b0e1316b4a6 pkg:maven/org.eclipse.jetty/jetty-io@9.3.24.v20180605 jetty-security-9.3.24.v20180605.jarFile Path: /root/.m2/repository/org/eclipse/jetty/jetty-security/9.3.24.v20180605/jetty-security-9.3.24.v20180605.jar MD5: a1bbf02768bd2028a91fb28cd2b75125 SHA1: dfc4e2169f3dd91954804e7fdff9c4f67c63f385 SHA256: e0215ac9bb1c8bfcfa761dc7f6ac2843eb8e3cdd063d7f7eaae213e2deef27d6 pkg:maven/org.eclipse.jetty/jetty-security@9.3.24.v20180605 jetty-servlet-9.3.24.v20180605.jarFile Path: /root/.m2/repository/org/eclipse/jetty/jetty-servlet/9.3.24.v20180605/jetty-servlet-9.3.24.v20180605.jar MD5: 46ba06055a66b8e503d324b8b369887b SHA1: db09c8e226c07c46dc3d84626fc97955ec6bf8bf SHA256: efe131191609aef8e51db96c57fda9f40ad481cc30084b3e2fddc3908cc675d8 pkg:maven/org.eclipse.jetty/jetty-servlet@9.3.24.v20180605 CVE-2018-12545 suppress
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-28165 suppress
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. CWE-755 Improper Handling of Exceptional Conditions
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w CONFIRM - https://security.netapp.com/advisory/ntap-20210611-0006/ DEBIAN - DSA-4949 MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [hbase-commits] 20210408 [hbase-thirdparty] branch master updated: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 (#49) MLIST - [hbase-dev] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [GitHub] [hbase-thirdparty] apurtell merged pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [ignite-dev] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Commented] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) Upgrade Jetty version to fix CVE-2021-2816[3,4,5] in Jetty MLIST - [kafka-dev] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-dev] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr opened a new pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Assigned] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 merged pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] edwin092 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210715 [jira] [Commented] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [oss-security] 20210420 Vulnerability in Jenkins MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] dinghram opened a new pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] merlimat commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai closed pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [solr-issues] 20210414 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210507 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210623 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210813 [jira] [Resolved] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [spark-commits] 20210408 [spark] branch branch-2.4 updated: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-commits] 20210408 [spark] branch branch-3.0 updated: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Assigned] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Commented] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Created] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Resolved] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Updated] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] HyukjinKwon commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk closed pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun closed pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun edited a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] viirya commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] jeffreysmooth commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6.3 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch master updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-dev] 20210407 Re: [VOTE] Apache ZooKeeper release 3.6.3 candidate 1 MLIST - [zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.38 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad closed pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] asfgit closed pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 N/A - N/A Vulnerable Software & Versions: (show all )
CVE-2022-2048 suppress
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-27216 suppress
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (4.4) Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2019-10241 suppress
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-10247 suppress
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-28169 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-34428 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. CWE-613 Insufficient Session Expiration
CVSSv2:
Base Score: LOW (3.6) Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: LOW (3.5) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-2047 suppress
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:N/I:P/A:N CVSSv3:
Base Score: LOW (2.7) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Utility classes for Jetty License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php File Path: /root/.m2/repository/org/eclipse/jetty/jetty-util/9.3.24.v20180605/jetty-util-9.3.24.v20180605.jar
MD5: 3b9e470ba1ad988111c8459e14a74c3c
SHA1: f74fb3f999e658a2ddea397155e20da5b9126b5d
SHA256: 7d77c6f41a70b12dd188056517bc20e484f5b12ae4e6aac700e6ffb941815763
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name jetty-util High Vendor jar package name eclipse Highest Vendor jar package name jetty Highest Vendor jar package name util Highest Vendor Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Vendor Manifest bundle-docurl http://www.eclipse.org/jetty Low Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Vendor Manifest bundle-symbolicname org.eclipse.jetty.util Medium Vendor Manifest Implementation-Vendor Eclipse.org - Jetty High Vendor Manifest originally-created-by Apache Maven Bundle Plugin Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest url http://www.eclipse.org/jetty Low Vendor pom artifactid jetty-util Highest Vendor pom artifactid jetty-util Low Vendor pom groupid org.eclipse.jetty Highest Vendor pom name Jetty :: Utilities High Vendor pom parent-artifactid jetty-project Low Vendor pom url http://www.eclipse.org/jetty Highest Product file name jetty-util High Product jar package name eclipse Highest Product jar package name jetty Highest Product jar package name util Highest Product Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Product Manifest bundle-docurl http://www.eclipse.org/jetty Low Product Manifest Bundle-Name Jetty :: Utilities Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Product Manifest bundle-symbolicname org.eclipse.jetty.util Medium Product Manifest originally-created-by Apache Maven Bundle Plugin Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest url http://www.eclipse.org/jetty Low Product pom artifactid jetty-util Highest Product pom groupid org.eclipse.jetty Highest Product pom name Jetty :: Utilities High Product pom parent-artifactid jetty-project Medium Product pom url http://www.eclipse.org/jetty Medium Version file version 9.3.24.v20180605 High Version Manifest Bundle-Version 9.3.24.v20180605 High Version Manifest Implementation-Version 9.3.24.v20180605 High Version pom version 9.3.24.v20180605 Highest
CVE-2018-12545 suppress
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-28165 suppress
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. CWE-755 Improper Handling of Exceptional Conditions
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w CONFIRM - https://security.netapp.com/advisory/ntap-20210611-0006/ DEBIAN - DSA-4949 MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [hbase-commits] 20210408 [hbase-thirdparty] branch master updated: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 (#49) MLIST - [hbase-dev] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [GitHub] [hbase-thirdparty] apurtell merged pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [ignite-dev] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Commented] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) Upgrade Jetty version to fix CVE-2021-2816[3,4,5] in Jetty MLIST - [kafka-dev] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-dev] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr opened a new pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Assigned] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 merged pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] edwin092 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210715 [jira] [Commented] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [oss-security] 20210420 Vulnerability in Jenkins MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] dinghram opened a new pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] merlimat commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai closed pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [solr-issues] 20210414 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210507 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210623 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210813 [jira] [Resolved] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [spark-commits] 20210408 [spark] branch branch-2.4 updated: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-commits] 20210408 [spark] branch branch-3.0 updated: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Assigned] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Commented] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Created] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Resolved] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Updated] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] HyukjinKwon commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk closed pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun closed pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun edited a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] viirya commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] jeffreysmooth commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6.3 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch master updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-dev] 20210407 Re: [VOTE] Apache ZooKeeper release 3.6.3 candidate 1 MLIST - [zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.38 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad closed pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] asfgit closed pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 N/A - N/A Vulnerable Software & Versions: (show all )
CVE-2022-2048 suppress
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-27216 suppress
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (4.4) Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2019-10241 suppress
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-10246 (OSSINDEX)suppress
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.3) Vector: /AV:N/AC:L/Au:/C:L/I:N/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.eclipse.jetty:jetty-util:9.3.24.v20180605:*:*:*:*:*:*:* CVE-2019-10247 suppress
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-28169 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-34428 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. CWE-613 Insufficient Session Expiration
CVSSv2:
Base Score: LOW (3.6) Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: LOW (3.5) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-2047 suppress
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:N/I:P/A:N CVSSv3:
Base Score: LOW (2.7) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
The jetty xml utilities. License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php File Path: /root/.m2/repository/org/eclipse/jetty/jetty-xml/9.4.6.v20170531/jetty-xml-9.4.6.v20170531.jar
MD5: 7a6d5917b1c066cfef3b046f9c44ba3b
SHA1: 25818a656163364b89966fbfdc6f43a8d8b65d2a
SHA256: 73a6460c8f856cadeb4f9b2469532b9ac2a5f9de2b6cdefe81aabd73a5a89a6d
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name jetty-xml High Vendor jar package name eclipse Highest Vendor jar package name jetty Highest Vendor jar package name xml Highest Vendor Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Vendor Manifest bundle-docurl http://www.eclipse.org/jetty Low Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Vendor Manifest bundle-symbolicname org.eclipse.jetty.xml Medium Vendor Manifest Implementation-Vendor Eclipse.org - Jetty High Vendor Manifest originally-created-by Apache Maven Bundle Plugin Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest url http://www.eclipse.org/jetty Low Vendor pom artifactid jetty-xml Highest Vendor pom artifactid jetty-xml Low Vendor pom groupid org.eclipse.jetty Highest Vendor pom name Jetty :: XML utilities High Vendor pom parent-artifactid jetty-project Low Vendor pom url http://www.eclipse.org/jetty Highest Product file name jetty-xml High Product jar package name eclipse Highest Product jar package name jetty Highest Product jar package name xml Highest Product Manifest bundle-copyright Copyright (c) 2008-2017 Mort Bay Consulting Pty. Ltd. Low Product Manifest bundle-docurl http://www.eclipse.org/jetty Low Product Manifest Bundle-Name Jetty :: XML utilities Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Product Manifest bundle-symbolicname org.eclipse.jetty.xml Medium Product Manifest originally-created-by Apache Maven Bundle Plugin Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest url http://www.eclipse.org/jetty Low Product pom artifactid jetty-xml Highest Product pom groupid org.eclipse.jetty Highest Product pom name Jetty :: XML utilities High Product pom parent-artifactid jetty-project Medium Product pom url http://www.eclipse.org/jetty Medium Version file version 9.4.6.v20170531 High Version Manifest Bundle-Version 9.4.6.v20170531 High Version Manifest Implementation-Version 9.4.6.v20170531 High Version pom version 9.4.6.v20170531 Highest
Related Dependencies jetty-webapp-9.4.6.v20170531.jarFile Path: /root/.m2/repository/org/eclipse/jetty/jetty-webapp/9.4.6.v20170531/jetty-webapp-9.4.6.v20170531.jar MD5: 78645f21330a231b7a6f67838de4f648 SHA1: 3e64618f88061ecd5538e6092f44e7410609e41c SHA256: 67e15f3681ba136cca49710b67c45a3834fed247eab8959082e2d145831380ce pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.6.v20170531 CVE-2017-7657 suppress
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling'), CWE-190 Integer Overflow or Wraparound
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-7658 suppress
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-12538 suppress
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore. CWE-384 Session Fixation
CVSSv2:
Base Score: MEDIUM (6.5) Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-7656 suppress
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-12545 suppress
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-28165 suppress
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. CWE-755 Improper Handling of Exceptional Conditions
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w CONFIRM - https://security.netapp.com/advisory/ntap-20210611-0006/ DEBIAN - DSA-4949 MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [hbase-commits] 20210408 [hbase-thirdparty] branch master updated: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 (#49) MLIST - [hbase-dev] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [GitHub] [hbase-thirdparty] apurtell merged pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [ignite-dev] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Commented] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) Upgrade Jetty version to fix CVE-2021-2816[3,4,5] in Jetty MLIST - [kafka-dev] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-dev] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr opened a new pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Assigned] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 merged pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] edwin092 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210715 [jira] [Commented] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [oss-security] 20210420 Vulnerability in Jenkins MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] dinghram opened a new pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] merlimat commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai closed pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [solr-issues] 20210414 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210507 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210623 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210813 [jira] [Resolved] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [spark-commits] 20210408 [spark] branch branch-2.4 updated: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-commits] 20210408 [spark] branch branch-3.0 updated: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Assigned] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Commented] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Created] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Resolved] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Updated] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] HyukjinKwon commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk closed pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun closed pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun edited a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] viirya commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] jeffreysmooth commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6.3 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch master updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-dev] 20210407 Re: [VOTE] Apache ZooKeeper release 3.6.3 candidate 1 MLIST - [zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.38 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad closed pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] asfgit closed pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 N/A - N/A Vulnerable Software & Versions: (show all )
CVE-2022-2048 suppress
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-27216 suppress
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (4.4) Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2019-10241 suppress
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-12536 suppress
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-10247 suppress
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. CWE-200 Information Exposure
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2020-27223 suppress
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2021-28169 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2020-27218 suppress
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.8) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:P CVSSv3:
Base Score: MEDIUM (4.8) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2021-34428 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. CWE-613 Insufficient Session Expiration
CVSSv2:
Base Score: LOW (3.6) Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: LOW (3.5) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-2047 suppress
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:N/I:P/A:N CVSSv3:
Base Score: LOW (2.7) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
JLine is a java library for reading and editing user input in console applications. It features tab-completion, command history, password masking, customizable keybindings, and pass-through handlers to use to chain to other console applications. License:
BSD: LICENSE.txt File Path: /root/.m2/repository/jline/jline/0.9.94/jline-0.9.94.jar
MD5: 46235c960277206f00fe24714437bc89
SHA1: 99a18e9a44834afdebc467294e1138364c207402
SHA256: d8df0ffb12d87ca876271cda4d59b3feb94123882c1be1763b7faf2e0a0b0cbb
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name jline High Vendor jar package name history Highest Vendor jar package name jline Highest Vendor jar package name jline Low Vendor pom artifactid jline Highest Vendor pom artifactid jline Low Vendor pom developer email mwp1@cornell.edu Low Vendor pom developer id mprudhom Medium Vendor pom developer name Marc Prud'hommeaux Medium Vendor pom groupid jline Highest Vendor pom name JLine High Vendor pom url http://jline.sourceforge.net Highest Product file name jline High Product jar package name history Highest Product jar package name jline Highest Product pom artifactid jline Highest Product pom developer email mwp1@cornell.edu Low Product pom developer id mprudhom Low Product pom developer name Marc Prud'hommeaux Low Product pom groupid jline Highest Product pom name JLine High Product pom url http://jline.sourceforge.net Medium Version file version 0.9.94 High Version pom version 0.9.94 Highest
File Path: /root/.m2/repository/jline/jline/0.9.94/jline-0.9.94.jar/jline/jline32.dllMD5: b3d9a08ff70440ba3638a325512f2cd8SHA1: 67a55d8f8ca4937d784d4334e554770adc2a1079SHA256: 3ddb21ed441296861413cfd109c61f12626ecc66ece659754b621d295fe9b23cReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name jline32 High Product file name jline32 High Version file name jline32 Medium Version file version 32 Medium
File Path: /root/.m2/repository/jline/jline/0.9.94/jline-0.9.94.jar/jline/jline64.dllMD5: d2f7b0db1231aac1846a857f5c0c4f2cSHA1: e297e4e990ce820e64d41f3f27b9be90283f3f96SHA256: f496874c86992b7436962451e05d1ffc9ca32ab64ce819501c42d807670e376eReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name jline64 High Product file name jline64 High Version file name jline64 Medium Version file version 64 Medium
Description:
Date and time library to replace JDK date handling License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/joda-time/joda-time/2.9.1/joda-time-2.9.1.jar
MD5: 40e3bd5a6dfe51f8ffc7f5f93294fe07
SHA1: c261495d1e01df849cdb3cbc941564018f0d3539
SHA256: c508f78ed9ac388cfccad7974ee282175f05ae25b68f0cc6eef21f8aeb3ceeaa
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name joda-time High Vendor jar package name joda Highest Vendor jar package name time Highest Vendor Manifest bundle-docurl http://www.joda.org/joda-time/ Low Vendor Manifest bundle-symbolicname joda-time Medium Vendor Manifest extension-name joda-time Medium Vendor Manifest implementation-url http://www.joda.org/joda-time/ Low Vendor Manifest Implementation-Vendor Joda.org High Vendor Manifest Implementation-Vendor-Id org.joda Medium Vendor Manifest specification-vendor Joda.org Low Vendor pom artifactid joda-time Highest Vendor pom artifactid joda-time Low Vendor pom developer id broneill Medium Vendor pom developer id jodastephen Medium Vendor pom developer name Brian S O'Neill Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom groupid joda-time Highest Vendor pom name Joda-Time High Vendor pom organization name Joda.org High Vendor pom organization url http://www.joda.org Medium Vendor pom url http://www.joda.org/joda-time/ Highest Product file name joda-time High Product jar package name joda Highest Product jar package name time Highest Product Manifest bundle-docurl http://www.joda.org/joda-time/ Low Product Manifest Bundle-Name Joda-Time Medium Product Manifest bundle-symbolicname joda-time Medium Product Manifest extension-name joda-time Medium Product Manifest Implementation-Title org.joda.time High Product Manifest implementation-url http://www.joda.org/joda-time/ Low Product Manifest specification-title Joda-Time Medium Product pom artifactid joda-time Highest Product pom developer id broneill Low Product pom developer id jodastephen Low Product pom developer name Brian S O'Neill Low Product pom developer name Stephen Colebourne Low Product pom groupid joda-time Highest Product pom name Joda-Time High Product pom organization name Joda.org Low Product pom organization url http://www.joda.org Low Product pom url http://www.joda.org/joda-time/ Medium Version file version 2.9.1 High Version Manifest Bundle-Version 2.9.1 High Version Manifest Implementation-Version 2.9.1 High Version pom version 2.9.1 Highest
Description:
Date and time library to replace JDK date handling License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/joda-time/joda-time/2.9.3/joda-time-2.9.3.jar
MD5: 9ffc66df25680a22463b41de17b3be5d
SHA1: 9e46be514a4ed60bcfbaaba88a3c668cf30476ab
SHA256: a05f5b8b021802a71919b18702aebdf286148188b3ee9d26e6ec40e8d0071487
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name joda-time High Vendor jar package name joda Highest Vendor jar package name time Highest Vendor Manifest bundle-docurl http://www.joda.org/joda-time/ Low Vendor Manifest bundle-symbolicname joda-time Medium Vendor Manifest extension-name joda-time Medium Vendor Manifest implementation-url http://www.joda.org/joda-time/ Low Vendor Manifest Implementation-Vendor Joda.org High Vendor Manifest Implementation-Vendor-Id org.joda Medium Vendor Manifest specification-vendor Joda.org Low Vendor pom artifactid joda-time Highest Vendor pom artifactid joda-time Low Vendor pom developer id broneill Medium Vendor pom developer id jodastephen Medium Vendor pom developer name Brian S O'Neill Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom groupid joda-time Highest Vendor pom name Joda-Time High Vendor pom organization name Joda.org High Vendor pom organization url http://www.joda.org Medium Vendor pom url http://www.joda.org/joda-time/ Highest Product file name joda-time High Product jar package name joda Highest Product jar package name time Highest Product Manifest bundle-docurl http://www.joda.org/joda-time/ Low Product Manifest Bundle-Name Joda-Time Medium Product Manifest bundle-symbolicname joda-time Medium Product Manifest extension-name joda-time Medium Product Manifest Implementation-Title org.joda.time High Product Manifest implementation-url http://www.joda.org/joda-time/ Low Product Manifest specification-title Joda-Time Medium Product pom artifactid joda-time Highest Product pom developer id broneill Low Product pom developer id jodastephen Low Product pom developer name Brian S O'Neill Low Product pom developer name Stephen Colebourne Low Product pom groupid joda-time Highest Product pom name Joda-Time High Product pom organization name Joda.org Low Product pom organization url http://www.joda.org Low Product pom url http://www.joda.org/joda-time/ Medium Version file version 2.9.3 High Version Manifest Bundle-Version 2.9.3 High Version Manifest Implementation-Version 2.9.3 High Version pom version 2.9.3 Highest
Description:
Jodd Core tools and utilities, including type converters, JDateTime, cache etc. License:
The New BSD License: http://jodd.org/license.html File Path: /root/.m2/repository/org/jodd/jodd-core/3.5.2/jodd-core-3.5.2.jar
MD5: 22c37c2de6e254dff68b787da51e160e
SHA1: a9ac8028eeeb5fa430e17017628629c94123c401
SHA256: 562478781548bd9cbdeef87f940967cf5cbcd5c1e6497a9056c8c89e603ec9be
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jodd-core High Vendor jar package name cache Highest Vendor jar package name jdatetime Highest Vendor jar package name jodd Highest Vendor Manifest bundle-docurl http://jodd.org Low Vendor Manifest bundle-symbolicname org.jodd.core Medium Vendor Manifest debug-info on Low Vendor Manifest Implementation-Vendor Jodd Team High Vendor pom artifactid jodd-core Highest Vendor pom artifactid jodd-core Low Vendor pom developer email igor@jodd.org Low Vendor pom developer id igor Medium Vendor pom developer name Igor Spasic Medium Vendor pom groupid org.jodd Highest Vendor pom name Jodd Core High Vendor pom organization name Jodd High Vendor pom organization url http://jodd.org Medium Vendor pom url http://jodd.org Highest Product file name jodd-core High Product jar package name cache Highest Product jar package name jdatetime Highest Product jar package name jodd Highest Product Manifest bundle-docurl http://jodd.org Low Product Manifest Bundle-Name Jodd Core Medium Product Manifest bundle-symbolicname org.jodd.core Medium Product Manifest debug-info on Low Product Manifest Implementation-Title Jodd Core High Product pom artifactid jodd-core Highest Product pom developer email igor@jodd.org Low Product pom developer id igor Low Product pom developer name Igor Spasic Low Product pom groupid org.jodd Highest Product pom name Jodd Core High Product pom organization name Jodd Low Product pom organization url http://jodd.org Low Product pom url http://jodd.org Medium Version file version 3.5.2 High Version Manifest Bundle-Version 3.5.2 High Version Manifest Implementation-Version 3.5.2 High Version pom version 3.5.2 Highest
CVE-2018-21234 suppress
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/jquery.dataTables.min.jsMD5: bcf14f55a3878cef5e522906ce13235bSHA1: 588658fcd1f3acda0cd435dd583b1fe869d8f67bSHA256: 8f4d3b47b47a8a31163dad5d7fb15e27a0056d07b0c34c6089fd9225664e847cReferenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
JSch is a pure Java implementation of SSH2 License:
BSD: http://www.jcraft.com/jsch/LICENSE.txt File Path: /root/.m2/repository/com/jcraft/jsch/0.1.42/jsch-0.1.42.jar
MD5: 74ea920580077b4c0b51101a8292a529
SHA1: a86104b0f2e0c0bab5b0df836065823a99b5e334
SHA256: 74297550aecc3b566ee19e49befb9cd49e2326c9d8d71ad5071bacc655b760dc
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided Evidence Type Source Name Value Confidence Vendor file name jsch High Vendor jar package name jcraft Highest Vendor jar package name jcraft Low Vendor jar package name jsch Highest Vendor jar package name jsch Low Vendor pom artifactid jsch Highest Vendor pom artifactid jsch Low Vendor pom groupid com.jcraft Highest Vendor pom name JSch High Vendor pom organization name jcraft High Vendor pom organization url http://www.jcraft.com/jsch Medium Vendor pom url http://www.jcraft.com/jsch/ Highest Product file name jsch High Product jar package name jcraft Highest Product jar package name jsch Highest Product jar package name jsch Low Product pom artifactid jsch Highest Product pom groupid com.jcraft Highest Product pom name JSch High Product pom organization name jcraft Low Product pom organization url http://www.jcraft.com/jsch Low Product pom url http://www.jcraft.com/jsch/ Medium Version file version 0.1.42 High Version pom version 0.1.42 Highest
CVE-2016-5725 suppress
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
Description:
json4s-ast License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-ast_2.11/3.5.3/json4s-ast_2.11-3.5.3.jar
MD5: d6fa477dc3eb6993a089eba1ccc8011e
SHA1: f1b60133c0667114a02e122d7f05e334dadc03a7
SHA256: 66659e7e7c3f744eceba8038a537aea39a8a416f9f830adb253eca18a36128ad
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name json4s-ast_2.11-3.5.3 High Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-ast_2.11 Highest Vendor pom artifactid json4s-ast_2.11 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-ast High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-ast_2.11-3.5.3 High Product jar package name json4s Highest Product Manifest Implementation-Title json4s-ast High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-ast Medium Product pom artifactid json4s-ast_2.11 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-ast High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-ast License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-ast_2.12/3.5.3/json4s-ast_2.12-3.5.3.jar
MD5: 874bb12065ad37c9fdd7b7bbd3451c8f
SHA1: b5b380b29e6958126f423898b18985e123ccc903
SHA256: d3e98823cad21c00376121e53b75c9c25b4b235508ac14da36d50eabf419702f
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile Evidence Type Source Name Value Confidence Vendor file name json4s-ast_2.12-3.5.3 High Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-ast_2.12 Highest Vendor pom artifactid json4s-ast_2.12 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-ast High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-ast_2.12-3.5.3 High Product jar package name json4s Highest Product Manifest Implementation-Title json4s-ast High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-ast Medium Product pom artifactid json4s-ast_2.12 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-ast High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-core License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-core_2.11/3.5.3/json4s-core_2.11-3.5.3.jar
MD5: 20d39eb37345873b8cc1f08fca0a51f5
SHA1: 4ea70f8fec94e03341c81d21e924d8c469ef0b61
SHA256: e3fa5e679b63bd5df561624108b772c19d9c3541d1949449dbbb61e4eee328ea
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name json4s-core_2.11-3.5.3 High Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-core_2.11 Highest Vendor pom artifactid json4s-core_2.11 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-core High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-core_2.11-3.5.3 High Product jar package name json4s Highest Product Manifest Implementation-Title json4s-core High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-core Medium Product pom artifactid json4s-core_2.11 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-core High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-core License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-core_2.12/3.5.3/json4s-core_2.12-3.5.3.jar
MD5: d72a1e9c1b10a7be0d5cba261e9fca75
SHA1: 607a376387d30ce87ed5f633f3e129b7a6101912
SHA256: f22d9dffa759f89c2f97219c276efbf2fcec93ed41168dc9860453f0884df1e3
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile Evidence Type Source Name Value Confidence Vendor file name json4s-core_2.12-3.5.3 High Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-core_2.12 Highest Vendor pom artifactid json4s-core_2.12 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-core High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-core_2.12-3.5.3 High Product jar package name json4s Highest Product Manifest Implementation-Title json4s-core High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-core Medium Product pom artifactid json4s-core_2.12 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-core High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-jackson License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-jackson_2.11/3.5.3/json4s-jackson_2.11-3.5.3.jar
MD5: cbe4e8d6dcaded1c4193b629009e7153
SHA1: 733a711a66d8eecbde9cfd7618235eae0d349a6d
SHA256: 228e25ecc31796340544c49e4b5ca97aceb9a345970b5b67b800a77cfdce9730
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name json4s-jackson_2.11-3.5.3 High Vendor jar package name jackson Highest Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-jackson_2.11 Highest Vendor pom artifactid json4s-jackson_2.11 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-jackson High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-jackson_2.11-3.5.3 High Product jar package name jackson Highest Product jar package name json4s Highest Product Manifest Implementation-Title json4s-jackson High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-jackson Medium Product pom artifactid json4s-jackson_2.11 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-jackson High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-jackson License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-jackson_2.12/3.5.3/json4s-jackson_2.12-3.5.3.jar
MD5: 4b38ac21284874013a5b0675fa0d5941
SHA1: 284f9c35c34f758e8be8a33ec710946075988f0c
SHA256: 5d4754659b4b87a0e6a8e00cc595c2922dd495e92eab74f0c5986a92455cfe25
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile Evidence Type Source Name Value Confidence Vendor file name json4s-jackson_2.12-3.5.3 High Vendor jar package name jackson Highest Vendor jar package name json4s Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-jackson_2.12 Highest Vendor pom artifactid json4s-jackson_2.12 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-jackson High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-jackson_2.12-3.5.3 High Product jar package name jackson Highest Product jar package name json4s Highest Product Manifest Implementation-Title json4s-jackson High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-jackson Medium Product pom artifactid json4s-jackson_2.12 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-jackson High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-scalap License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-scalap_2.11/3.5.3/json4s-scalap_2.11-3.5.3.jar
MD5: 769f3cd3c587adfa54ba794b108fd193
SHA1: a78590f694a565a63ca6ba0eae8cd19f52d79ec4
SHA256: 972201e8e0ac11a79abebde92a3a918365001c5e3bfc0bd93d0f809550bce854
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name json4s-scalap_2.11-3.5.3 High Vendor jar package name json4s Highest Vendor jar package name scalap Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-scalap_2.11 Highest Vendor pom artifactid json4s-scalap_2.11 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-scalap High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-scalap_2.11-3.5.3 High Product jar package name json4s Highest Product jar package name scalap Highest Product Manifest Implementation-Title json4s-scalap High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-scalap Medium Product pom artifactid json4s-scalap_2.11 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-scalap High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-scalap License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-scalap_2.12/3.5.3/json4s-scalap_2.12-3.5.3.jar
MD5: 3cd4717522941dddb3c9961306b8453b
SHA1: fa973e0c8d3fe988e469753a9c2d922660c9f0f4
SHA256: 5866d348b962e9e239bcaf3c0634fc9d93a3718098eb3230ee75ebde1129d3d1
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile Evidence Type Source Name Value Confidence Vendor file name json4s-scalap_2.12-3.5.3 High Vendor jar package name json4s Highest Vendor jar package name scalap Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-scalap_2.12 Highest Vendor pom artifactid json4s-scalap_2.12 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-scalap High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-scalap_2.12-3.5.3 High Product jar package name json4s Highest Product jar package name scalap Highest Product Manifest Implementation-Title json4s-scalap High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-scalap Medium Product pom artifactid json4s-scalap_2.12 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-scalap High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.5.3 High Version pom version 3.5.3 Highest
Description:
json4s-xml License:
Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/json4s/json4s-xml_2.11/3.6.3/json4s-xml_2.11-3.6.3.jar
MD5: 4af379f6135c9e373552333b87fa0105
SHA1: 58cc93c75390ad3dadf53ced91424ac1345deb57
SHA256: 3f9fff75fa0f0697823c9166b3ad3ebee076dba63013dc12164d2c1dc35f58f6
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name json4s-xml_2.11-3.6.3 High Vendor jar package name json4s Highest Vendor jar package name xml Highest Vendor Manifest implementation-url https://github.com/json4s/json4s Low Vendor Manifest Implementation-Vendor org.json4s High Vendor Manifest Implementation-Vendor-Id org.json4s Medium Vendor Manifest specification-vendor org.json4s Low Vendor pom artifactid json4s-xml_2.11 Highest Vendor pom artifactid json4s-xml_2.11 Low Vendor pom developer id casualjim Medium Vendor pom developer id seratch Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom groupid org.json4s Highest Vendor pom name json4s-xml High Vendor pom organization name org.json4s High Vendor pom organization url json4s/json4s Medium Vendor pom url json4s/json4s Highest Product file name json4s-xml_2.11-3.6.3 High Product jar package name json4s Highest Product jar package name xml Highest Product Manifest Implementation-Title json4s-xml High Product Manifest implementation-url https://github.com/json4s/json4s Low Product Manifest specification-title json4s-xml Medium Product pom artifactid json4s-xml_2.11 Highest Product pom developer id casualjim Low Product pom developer id seratch Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Kazuhiro Sera Low Product pom groupid org.json4s Highest Product pom name json4s-xml High Product pom organization name org.json4s Low Product pom url json4s/json4s High Version Manifest Implementation-Version 3.6.3 High Version pom version 3.6.3 Highest
File Path: /root/.m2/repository/javax/servlet/jsp/jsp-api/2.1/jsp-api-2.1.jarMD5: b8a34113a3a1ce29c8c60d7141f5a704SHA1: 63f943103f250ef1f3a4d5e94d145a0f961f5316SHA256: 545f4e7dc678ffb4cf8bd0fd40b4a4470a409a787c0ea7d0ad2f08d56112987bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-server:runtime livy-rsc:provided livy-examples:runtime livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-coverage-report:runtime livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-assembly:runtime livy-integration-test:runtime livy-repl_2.12:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jsp-api High Vendor jar package name javax Highest Vendor jar package name jsp Highest Vendor jar package name servlet Highest Vendor Manifest extension-name javax.servlet.jsp Medium Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom artifactid jsp-api Highest Vendor pom artifactid jsp-api Low Vendor pom groupid javax.servlet.jsp Highest Product file name jsp-api High Product jar package name javax Highest Product jar package name jsp Highest Product jar package name servlet Highest Product Manifest extension-name javax.servlet.jsp Medium Product Manifest specification-title JavaServer Pages(TM) Specification Medium Product pom artifactid jsp-api Highest Product pom groupid javax.servlet.jsp Highest Version file version 2.1 High Version Manifest Implementation-Version 2.1 High Version pom version 2.1 Highest
Description:
JSR305 Annotations for Findbugs License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar
MD5: 1d5a772e400b04bb67a7ef4a0e0996d8
SHA1: 40719ea6961c0cb6afaeb6a921eaa1f6afd4cfdf
SHA256: 905721a0eea90a81534abb7ee6ef4ea2e5e645fa1def0a5cd88402df1b46c9ed
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jsr305 High Vendor jar package name annotation Low Vendor jar package name javax Low Vendor pom artifactid jsr305 Highest Vendor pom artifactid jsr305 Low Vendor pom groupid com.google.code.findbugs Highest Vendor pom name FindBugs-jsr305 High Vendor pom url http://findbugs.sourceforge.net/ Highest Product file name jsr305 High Product jar package name annotation Low Product pom artifactid jsr305 Highest Product pom groupid com.google.code.findbugs Highest Product pom name FindBugs-jsr305 High Product pom url http://findbugs.sourceforge.net/ Medium Version file version 1.3.9 High Version pom version 1.3.9 Highest
Description:
JSR305 Annotations for Findbugs License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.jar
MD5: 195d5db8981fbec5fa18d5df9fad95ed
SHA1: 5871fb60dc68d67da54a663c3fd636a10a532948
SHA256: bec0b24dcb23f9670172724826584802b80ae6cbdaba03bdebdef9327b962f6a
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name jsr305 High Vendor jar package name annotation Low Vendor jar package name javax Low Vendor pom artifactid jsr305 Highest Vendor pom artifactid jsr305 Low Vendor pom developer email Loskutov@gmx.de Low Vendor pom developer email pugh at cs.umd.edu Low Vendor pom developer id al Medium Vendor pom developer id bp Medium Vendor pom developer name Andrey Loskutov Medium Vendor pom developer name Bill Pugh Medium Vendor pom developer name Keith Lea Medium Vendor pom groupid com.google.code.findbugs Highest Vendor pom name FindBugs-jsr305 High Vendor pom url http://findbugs.sourceforge.net/ Highest Product file name jsr305 High Product jar package name annotation Low Product pom artifactid jsr305 Highest Product pom developer email Loskutov@gmx.de Low Product pom developer email pugh at cs.umd.edu Low Product pom developer id al Low Product pom developer id bp Low Product pom developer name Andrey Loskutov Low Product pom developer name Bill Pugh Low Product pom developer name Keith Lea Low Product pom groupid com.google.code.findbugs Highest Product pom name FindBugs-jsr305 High Product pom url http://findbugs.sourceforge.net/ Medium Version file version 3.0.0 High Version pom version 3.0.0 Highest
Description:
The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation.
File Path: /root/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jarMD5: 82a10ce714f411b28f13850059de09eeSHA1: 2ca09f0b36ca7d71b762e14ea2ff09d5eac57558SHA256: b8ec163b4a47bad16f9a0b7d03c3210c6b0a29216d768031073ac20817c0ba50Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jta High Vendor jar package name javax Highest Vendor jar package name transaction Highest Vendor Manifest extension-name javax.transaction Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom artifactid jta Highest Vendor pom artifactid jta Low Vendor pom groupid javax.transaction Highest Vendor pom name Java Transaction API High Vendor pom url http://java.sun.com/products/jta Highest Product file name jta High Product jar package name javax Highest Product jar package name transaction Highest Product Manifest extension-name javax.transaction Medium Product Manifest specification-title Java Transaction API Specification Medium Product pom artifactid jta Highest Product pom groupid javax.transaction Highest Product pom name Java Transaction API High Product pom url http://java.sun.com/products/jta Medium Version file version 1.1 High Version Manifest specification-version 1.1 High Version pom version 1.1 Highest
Description:
JTransforms is the first, open source, multithreaded FFT library written in pure Java. Benchmark results show better performance than FFTW. License:
MPL: http://www.mozilla.org/MPL/2.0/index.txt
LGPL: http://www.gnu.org/licenses/lgpl-2.1.txt
GPL: http://www.gnu.org/licenses/gpl-2.0.txt File Path: /root/.m2/repository/com/github/rwl/jtransforms/2.4.0/jtransforms-2.4.0.jar
MD5: 9c9fe6cc3f85b1afebdbd7aa25b8a268
SHA1: 20ab3d14a0375cc2baee9452b92b217aac7e3c57
SHA256: 30be689d80d53a358951b183b083206430b7654199b13f6aa4b5e12078015f83
Referenced In Projects/Scopes: livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jtransforms High Vendor jar package name edu Low Vendor jar package name emory Low Vendor jar package name jtransforms Highest Vendor jar package name mathcs Low Vendor pom artifactid jtransforms Highest Vendor pom artifactid jtransforms Low Vendor pom developer email piotr.wendykier@gmail.com Low Vendor pom developer id wendykierp Medium Vendor pom developer name Piotr Wendykier Medium Vendor pom groupid com.github.rwl Highest Vendor pom name JTransforms High Vendor pom url http://sourceforge.net/projects/jtransforms/ Highest Product file name jtransforms High Product jar package name emory Low Product jar package name jtransforms Highest Product jar package name jtransforms Low Product jar package name mathcs Low Product pom artifactid jtransforms Highest Product pom developer email piotr.wendykier@gmail.com Low Product pom developer id wendykierp Low Product pom developer name Piotr Wendykier Low Product pom groupid com.github.rwl Highest Product pom name JTransforms High Product pom url http://sourceforge.net/projects/jtransforms/ Medium Version file version 2.4.0 High Version pom version 2.4.0 Highest
Description:
JUL to SLF4J bridge File Path: /root/.m2/repository/org/slf4j/jul-to-slf4j/1.7.16/jul-to-slf4j-1.7.16.jarMD5: 228ccd417ce9b7b6dcd78e8fee1a8ca0SHA1: 2d5b546c5557dcbf08c3a381d7dc9bd275a602c1SHA256: a67d98d27bfcbc120e0efbf47cf07fab85cb32b6b274d43257a29fa14bb659d0Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jul-to-slf4j High Vendor jar package name bridge Highest Vendor jar package name slf4j Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname jul.to.slf4j Medium Vendor pom artifactid jul-to-slf4j Highest Vendor pom artifactid jul-to-slf4j Low Vendor pom groupid org.slf4j Highest Vendor pom name JUL to SLF4J bridge High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name jul-to-slf4j High Product jar package name bridge Highest Product jar package name slf4j Highest Product Manifest Bundle-Name jul-to-slf4j Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname jul.to.slf4j Medium Product pom artifactid jul-to-slf4j Highest Product pom groupid org.slf4j Highest Product pom name JUL to SLF4J bridge High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.16 High Version Manifest Bundle-Version 1.7.16 High Version Manifest Implementation-Version 1.7.16 High Version pom version 1.7.16 Highest
Description:
Java port of universalchardet License:
Mozilla Public License 1.1 (MPL 1.1): http://www.mozilla.org/MPL/MPL-1.1.html File Path: /root/.m2/repository/com/googlecode/juniversalchardet/juniversalchardet/1.0.3/juniversalchardet-1.0.3.jar
MD5: d9ea0a9a275336c175b343f2e4cd8f27
SHA1: cd49678784c46aa8789c060538e0154013bb421b
SHA256: 757bfe906193b8b651e79dc26cd67d6b55d0770a2cdfb0381591504f779d4a76
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name juniversalchardet High Vendor jar package name mozilla Low Vendor jar package name prober Low Vendor jar package name universalchardet Highest Vendor jar package name universalchardet Low Vendor pom artifactid juniversalchardet Highest Vendor pom artifactid juniversalchardet Low Vendor pom developer email takscape@gmail.com Low Vendor pom developer id takscape Medium Vendor pom groupid com.googlecode.juniversalchardet Highest Vendor pom name juniversalchardet High Vendor pom url http://juniversalchardet.googlecode.com/ Highest Product file name juniversalchardet High Product jar package name prober Low Product jar package name universalchardet Highest Product jar package name universalchardet Low Product pom artifactid juniversalchardet Highest Product pom developer email takscape@gmail.com Low Product pom developer id takscape Low Product pom groupid com.googlecode.juniversalchardet Highest Product pom name juniversalchardet High Product pom url http://juniversalchardet.googlecode.com/ Medium Version file version 1.0.3 High Version pom version 1.0.3 Highest
Description:
High performance Java reflection using code generation License:
New BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/com/esotericsoftware/kryo-shaded/4.0.2/kryo-shaded-4.0.2.jar/META-INF/maven/com.esotericsoftware/reflectasm/pom.xml
MD5: 9ab3a0dad36d0b32447722ad06018470
SHA1: da632f37b4ae2181ea53e43b3212428c2a23c478
SHA256: 1c5a80634d547bf5ec80c71624db9d8837e2702d01375e3b8b5c0f32d1e81e61
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-repl-parent:compile livy-test-lib:provided livy-client-common:compile livy-rsc:compile livy-api:provided livy-core-parent:compile livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor pom artifactid reflectasm Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware Highest Vendor pom name ReflectASM High Vendor pom url EsotericSoftware/reflectasm Highest Product pom artifactid reflectasm Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware Highest Product pom name ReflectASM High Product pom url EsotericSoftware/reflectasm High Version pom version 1.11.3 Highest
Description:
Fast, efficient Java serialization. This is the parent pom that assembles the main kryo and shaded kryo artifacts. License:
3-Clause BSD License: https://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/com/esotericsoftware/kryo-shaded/4.0.2/kryo-shaded-4.0.2.jar
MD5: 27717b481916c44eed34ea7a68782ed5
SHA1: e8c89779f93091aa9cb895093402b5d15065bf88
SHA256: a4899f57fef456b9ec66f730e7b493ecb3dc494cc5758721ed9c18416fd2d3b6
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-repl-parent:compile livy-test-lib:provided livy-client-common:compile livy-rsc:compile livy-api:provided livy-core-parent:compile livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name kryo-shaded High Vendor jar package name esotericsoftware Highest Vendor jar package name kryo Highest Vendor jar package name reflectasm Highest Vendor jar package name shaded Highest Vendor Manifest bundle-symbolicname com.esotericsoftware.kryo-shaded Medium Vendor pom artifactid kryo-parent Low Vendor pom artifactid kryo-shaded Highest Vendor pom artifactid kryo-shaded Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware Highest Vendor pom name Kryo Parent High Vendor pom name Kryo Shaded High Vendor pom parent-artifactid kryo-parent Low Vendor pom url EsotericSoftware/kryo Highest Product file name kryo-shaded High Product jar package name esotericsoftware Highest Product jar package name kryo Highest Product jar package name reflectasm Highest Product jar package name shaded Highest Product Manifest Bundle-Name Kryo Shaded Medium Product Manifest bundle-symbolicname com.esotericsoftware.kryo-shaded Medium Product pom artifactid kryo-parent Highest Product pom artifactid kryo-shaded Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware Highest Product pom name Kryo Parent High Product pom name Kryo Shaded High Product pom parent-artifactid kryo-parent Medium Product pom url EsotericSoftware/kryo High Version file version 4.0.2 High Version Manifest Bundle-Version 4.0.2 High Version pom version 4.0.2 Highest
Description:
An uber jar which contains all the leveldbjni platform libraries and dependencies License:
http://www.opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/fusesource/leveldbjni/leveldbjni-all/1.8/leveldbjni-all-1.8.jar
MD5: 6944e9bc03c7938868e53c96726ae914
SHA1: 707350a2eeb1fa2ed77a32ddb3893ed308e941db
SHA256: c297213b0e6f9392305952753f3099a4c02e70b3656266fe01867e7b6c160ffe
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name leveldbjni-all High Vendor jar package name all Highest Vendor jar package name fusesource Highest Vendor jar package name leveldbjni Highest Vendor Manifest bundle-docurl http://fusesource.com/ Low Vendor Manifest bundle-nativecode META-INF/native/windows32/leveldbjni.dll;osname=Win32;processor=x86,META-INF/native/windows64/leveldbjni.dll;osname=Win32;processor=x86-64,META-INF/native/osx/libleveldbjni.jnilib;osname=macosx;processor=x86,META-INF/native/osx/libleveldbjni.jnilib;osname=macosx;processor=x86-64,META-INF/native/linux32/libleveldbjni.so;osname=Linux;processor=x86,META-INF/native/linux64/libleveldbjni.so;osname=Linux;processor=x86-64 Low Vendor Manifest bundle-symbolicname org.fusesource.leveldbjni.leveldbjni-all Medium Vendor Manifest embed-transitive true Low Vendor pom artifactid leveldbjni-all Highest Vendor pom artifactid leveldbjni-all Low Vendor pom groupid org.fusesource.leveldbjni Highest Vendor pom name ${project.artifactId} High Vendor pom parent-artifactid leveldbjni-project Low Product file name leveldbjni-all High Product jar package name all Highest Product jar package name fusesource Highest Product jar package name leveldb Highest Product jar package name leveldbjni Highest Product Manifest bundle-docurl http://fusesource.com/ Low Product Manifest Bundle-Name leveldbjni-all Medium Product Manifest bundle-nativecode META-INF/native/windows32/leveldbjni.dll;osname=Win32;processor=x86,META-INF/native/windows64/leveldbjni.dll;osname=Win32;processor=x86-64,META-INF/native/osx/libleveldbjni.jnilib;osname=macosx;processor=x86,META-INF/native/osx/libleveldbjni.jnilib;osname=macosx;processor=x86-64,META-INF/native/linux32/libleveldbjni.so;osname=Linux;processor=x86,META-INF/native/linux64/libleveldbjni.so;osname=Linux;processor=x86-64 Low Product Manifest bundle-symbolicname org.fusesource.leveldbjni.leveldbjni-all Medium Product Manifest embed-transitive true Low Product Manifest Implementation-Title LevelDB JNI High Product pom artifactid leveldbjni-all Highest Product pom groupid org.fusesource.leveldbjni Highest Product pom name ${project.artifactId} High Product pom parent-artifactid leveldbjni-project Medium Version file version 1.8 High Version Manifest Implementation-Version 1.8 High Version pom version 1.8 Highest
File Path: /root/.m2/repository/org/fusesource/leveldbjni/leveldbjni-all/1.8/leveldbjni-all-1.8.jar/META-INF/native/windows32/leveldbjni.dllMD5: 551b9310a9ed358359296a89715df2f4SHA1: bba450e93688b872b3fcaa31e8457950e97d8429SHA256: 3cf3f6284f99acad369a15f0b4eca8e0dec2b0342651c519e4665570da8a68eeReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name leveldbjni High Product file name leveldbjni High
File Path: /root/.m2/repository/org/fusesource/leveldbjni/leveldbjni-all/1.8/leveldbjni-all-1.8.jar/META-INF/native/windows64/leveldbjni.dllMD5: 4b6fa20009ca1eb556e752671461a3f2SHA1: 978ca9c96c03eb220556ce5bc96c715f95a0967cSHA256: 7794f7bbc848d1a9ad98996f2c68a1cf12ac17562f646c6d7f5733404a7b5ef1Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name leveldbjni High Product file name leveldbjni High
Description:
Thrift is a software framework for scalable cross-language services development. License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/thrift/libfb303/0.9.3/libfb303-0.9.3.jar
MD5: 5e1c646346ecf2750a1b8b6cb2aa1c4f
SHA1: 5d1abb695642e88558f4e7e0d32aa1925a1fd0b7
SHA256: 23fc397a42181b17bb7d0fada2213735ed8db38cfbf038d12b9c00ea7419e11b
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name libfb303 High Vendor jar package name facebook Low Vendor jar package name fb303 Low Vendor pom artifactid libfb303 Highest Vendor pom artifactid libfb303 Low Vendor pom developer id aditya Medium Vendor pom developer id bmaurer Medium Vendor pom developer id bryanduxbury Medium Vendor pom developer id carl Medium Vendor pom developer id cpiro Medium Vendor pom developer id dreiss Medium Vendor pom developer id esteve Medium Vendor pom developer id geechorama Medium Vendor pom developer id jake Medium Vendor pom developer id jensg Medium Vendor pom developer id jfarrell Medium Vendor pom developer id jwang Medium Vendor pom developer id kclark Medium Vendor pom developer id marck Medium Vendor pom developer id mcslee Medium Vendor pom developer id molinaro Medium Vendor pom developer id roger Medium Vendor pom developer id todd Medium Vendor pom developer name Aditya Agarwal Medium Vendor pom developer name Andrew McGeachie Medium Vendor pom developer name Anthony Molinaro Medium Vendor pom developer name Ben Maurer Medium Vendor pom developer name Bryan Duxbury Medium Vendor pom developer name Carl Yeksigian Medium Vendor pom developer name Chris Piro Medium Vendor pom developer name David Reiss Medium Vendor pom developer name Esteve Fernandez Medium Vendor pom developer name Jake Farrell Medium Vendor pom developer name Jake Luciani Medium Vendor pom developer name James Wang Medium Vendor pom developer name Jens Geyer Medium Vendor pom developer name Kevin Clark Medium Vendor pom developer name Marc Kwiatkowski Medium Vendor pom developer name Mark Slee Medium Vendor pom developer name Roger Meier Medium Vendor pom developer name Todd Lipcon Medium Vendor pom groupid org.apache.thrift Highest Vendor pom name Apache Thrift High Vendor pom url http://thrift.apache.org Highest Product file name libfb303 High Product jar package name fb303 Low Product pom artifactid libfb303 Highest Product pom developer id aditya Low Product pom developer id bmaurer Low Product pom developer id bryanduxbury Low Product pom developer id carl Low Product pom developer id cpiro Low Product pom developer id dreiss Low Product pom developer id esteve Low Product pom developer id geechorama Low Product pom developer id jake Low Product pom developer id jensg Low Product pom developer id jfarrell Low Product pom developer id jwang Low Product pom developer id kclark Low Product pom developer id marck Low Product pom developer id mcslee Low Product pom developer id molinaro Low Product pom developer id roger Low Product pom developer id todd Low Product pom developer name Aditya Agarwal Low Product pom developer name Andrew McGeachie Low Product pom developer name Anthony Molinaro Low Product pom developer name Ben Maurer Low Product pom developer name Bryan Duxbury Low Product pom developer name Carl Yeksigian Low Product pom developer name Chris Piro Low Product pom developer name David Reiss Low Product pom developer name Esteve Fernandez Low Product pom developer name Jake Farrell Low Product pom developer name Jake Luciani Low Product pom developer name James Wang Low Product pom developer name Jens Geyer Low Product pom developer name Kevin Clark Low Product pom developer name Marc Kwiatkowski Low Product pom developer name Mark Slee Low Product pom developer name Roger Meier Low Product pom developer name Todd Lipcon Low Product pom groupid org.apache.thrift Highest Product pom name Apache Thrift High Product pom url http://thrift.apache.org Medium Version file version 0.9.3 High Version pom version 0.9.3 Highest
CVE-2016-5397 suppress
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2018-1320 suppress
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-0205 suppress
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings. CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2019-0210 suppress
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data. CWE-125 Out-of-bounds Read
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-13949 suppress
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11798 suppress
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path. CWE-538 File and Directory Information Exposure
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
Thrift is a software framework for scalable cross-language services development. License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/thrift/libthrift/0.9.3/libthrift-0.9.3.jar
MD5: 96af680a50acae601ce823b1da70b24a
SHA1: 8625e8f9b6f49b881fa5fd143172c2833df1ce47
SHA256: bca5e8cdee1e0fbf563de7d41c452385e7bed69723fa28225a9ce718a8ee3419
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name libthrift High Vendor jar package name apache Highest Vendor jar package name thrift Highest Vendor Manifest bundle-activationpolicy lazy Low Vendor Manifest bundle-symbolicname org.apache.thrift Medium Vendor pom artifactid libthrift Highest Vendor pom artifactid libthrift Low Vendor pom developer id aditya Medium Vendor pom developer id bmaurer Medium Vendor pom developer id bryanduxbury Medium Vendor pom developer id carl Medium Vendor pom developer id cpiro Medium Vendor pom developer id dreiss Medium Vendor pom developer id esteve Medium Vendor pom developer id geechorama Medium Vendor pom developer id jake Medium Vendor pom developer id jensg Medium Vendor pom developer id jfarrell Medium Vendor pom developer id jwang Medium Vendor pom developer id kclark Medium Vendor pom developer id marck Medium Vendor pom developer id mcslee Medium Vendor pom developer id molinaro Medium Vendor pom developer id roger Medium Vendor pom developer id todd Medium Vendor pom developer name Aditya Agarwal Medium Vendor pom developer name Andrew McGeachie Medium Vendor pom developer name Anthony Molinaro Medium Vendor pom developer name Ben Maurer Medium Vendor pom developer name Bryan Duxbury Medium Vendor pom developer name Carl Yeksigian Medium Vendor pom developer name Chris Piro Medium Vendor pom developer name David Reiss Medium Vendor pom developer name Esteve Fernandez Medium Vendor pom developer name Jake Farrell Medium Vendor pom developer name Jake Luciani Medium Vendor pom developer name James Wang Medium Vendor pom developer name Jens Geyer Medium Vendor pom developer name Kevin Clark Medium Vendor pom developer name Marc Kwiatkowski Medium Vendor pom developer name Mark Slee Medium Vendor pom developer name Roger Meier Medium Vendor pom developer name Todd Lipcon Medium Vendor pom groupid org.apache.thrift Highest Vendor pom name Apache Thrift High Vendor pom url http://thrift.apache.org Highest Product file name libthrift High Product jar package name apache Highest Product jar package name thrift Highest Product Manifest bundle-activationpolicy lazy Low Product Manifest Bundle-Name Apache Thrift Medium Product Manifest bundle-symbolicname org.apache.thrift Medium Product pom artifactid libthrift Highest Product pom developer id aditya Low Product pom developer id bmaurer Low Product pom developer id bryanduxbury Low Product pom developer id carl Low Product pom developer id cpiro Low Product pom developer id dreiss Low Product pom developer id esteve Low Product pom developer id geechorama Low Product pom developer id jake Low Product pom developer id jensg Low Product pom developer id jfarrell Low Product pom developer id jwang Low Product pom developer id kclark Low Product pom developer id marck Low Product pom developer id mcslee Low Product pom developer id molinaro Low Product pom developer id roger Low Product pom developer id todd Low Product pom developer name Aditya Agarwal Low Product pom developer name Andrew McGeachie Low Product pom developer name Anthony Molinaro Low Product pom developer name Ben Maurer Low Product pom developer name Bryan Duxbury Low Product pom developer name Carl Yeksigian Low Product pom developer name Chris Piro Low Product pom developer name David Reiss Low Product pom developer name Esteve Fernandez Low Product pom developer name Jake Farrell Low Product pom developer name Jake Luciani Low Product pom developer name James Wang Low Product pom developer name Jens Geyer Low Product pom developer name Kevin Clark Low Product pom developer name Marc Kwiatkowski Low Product pom developer name Mark Slee Low Product pom developer name Roger Meier Low Product pom developer name Todd Lipcon Low Product pom groupid org.apache.thrift Highest Product pom name Apache Thrift High Product pom url http://thrift.apache.org Medium Version file version 0.9.3 High Version Manifest Bundle-Version 0.9.3 High Version Manifest Implementation-Version 0.9.3 High Version pom version 0.9.3 Highest
CVE-2016-5397 suppress
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2018-1320 suppress
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete. CWE-295 Improper Certificate Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-0205 suppress
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings. CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2019-0210 suppress
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data. CWE-125 Out-of-bounds Read
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-13949 suppress
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11798 suppress
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path. CWE-538 File and Directory Information Exposure
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/livy-ui.jsMD5: e87b1c8eeb2537bc3537bdcb4d3b04feSHA1: 8acdfae9480e285fede9053b583c704b81ec8050SHA256: 71e084a3b2f757222a232f42e6bdaa4b179c8e3ecf9d03532b345e8f4646a25bReferenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
Apache Log4j 1.2 License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/log4j/log4j/1.2.16/log4j-1.2.16.jar
MD5: 363678f015902bcc040308136f845a3f
SHA1: 7999a63bfccbc7c247a9aea10d83d4272bd492c6
SHA256: 7ae3fdde7ab0cae4735a2aec04381ad9b6e25c93d24205f3ed315d9866f12fe1
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name log4j High Vendor jar package name apache Highest Vendor jar package name log4j Highest Vendor Manifest bundle-docurl http://logging.apache.org/log4j/1.2 Low Vendor Manifest bundle-symbolicname log4j Medium Vendor manifest: org.apache.log4j Implementation-Vendor "Apache Software Foundation" Medium Vendor pom artifactid log4j Highest Vendor pom artifactid log4j Low Vendor pom groupid log4j Highest Vendor pom name Apache Log4j High Vendor pom organization name Apache Software Foundation High Vendor pom organization url http://www.apache.org Medium Vendor pom url http://logging.apache.org/log4j/1.2/ Highest Product file name log4j High Product jar package name apache Highest Product jar package name log4j Highest Product Manifest bundle-docurl http://logging.apache.org/log4j/1.2 Low Product Manifest Bundle-Name Apache Log4j Medium Product Manifest bundle-symbolicname log4j Medium Product manifest: org.apache.log4j Implementation-Title log4j Medium Product pom artifactid log4j Highest Product pom groupid log4j Highest Product pom name Apache Log4j High Product pom organization name Apache Software Foundation Low Product pom organization url http://www.apache.org Low Product pom url http://logging.apache.org/log4j/1.2/ Medium Version file version 1.2.16 High Version Manifest Bundle-Version 1.2.16 High Version manifest: org.apache.log4j Implementation-Version 1.2.16 Medium Version pom version 1.2.16 Highest
CVE-2019-17571 suppress
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-9493 suppress
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23305 suppress
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23302 suppress
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: MEDIUM (6.0) Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-23307 suppress
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (9.0) Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-4104 (OSSINDEX)suppress
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CWE-502 Deserialization of Untrusted Data
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:H/Au:/C:H/I:H/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:log4j:log4j:1.2.16:*:*:*:*:*:*:* Description:
Java ports and bindings of the LZ4 compression algorithm and the xxHash hashing algorithm License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/lz4/lz4-java/1.4.0/lz4-java-1.4.0.jar
MD5: 6af82e9b9f0db48ebf95e7118027e9e4
SHA1: db5083b84299ad982a19677316da9a49363ad6e0
SHA256: 58516caefbfd99b3c5bac4065ba416d8e596efc58de2a2cc58e8a9302946a61b
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name lz4-java High Vendor jar package name lz4 Highest Vendor jar package name xxhash Highest Vendor Manifest bundle-symbolicname lz4-java Medium Vendor Manifest originally-created-by 1.7.0_95-b00 (Oracle Corporation) Low Vendor pom artifactid lz4-java Highest Vendor pom artifactid lz4-java Low Vendor pom developer email jpountz@gmail.com Low Vendor pom developer email Rei.Odaira@gmail.com Low Vendor pom developer id jpountz Medium Vendor pom developer id odaira Medium Vendor pom developer name Adrien Grand Medium Vendor pom developer name Rei Odaira Medium Vendor pom groupid org.lz4 Highest Vendor pom name LZ4 and xxHash High Vendor pom url lz4/lz4-java Highest Product file name lz4-java High Product jar package name lz4 Highest Product jar package name xxhash Highest Product Manifest Bundle-Name lz4-java Medium Product Manifest bundle-symbolicname lz4-java Medium Product Manifest originally-created-by 1.7.0_95-b00 (Oracle Corporation) Low Product pom artifactid lz4-java Highest Product pom developer email jpountz@gmail.com Low Product pom developer email Rei.Odaira@gmail.com Low Product pom developer id jpountz Low Product pom developer id odaira Low Product pom developer name Adrien Grand Low Product pom developer name Rei Odaira Low Product pom groupid org.lz4 Highest Product pom name LZ4 and xxHash High Product pom url lz4/lz4-java High Version file version 1.4.0 High Version pom version 1.4.0 Highest
Description:
machinist License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/typelevel/machinist_2.11/0.6.1/machinist_2.11-0.6.1.jar
MD5: 7711b4715549c2241f05df0c35d84490
SHA1: 239a56280d1cf730048f552a1a18f415bfcbf270
SHA256: a8cad9216bbc29571be7cadf8c0269920d5af5682d24fc83828bd870f6a17dd9
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name machinist_2.11-0.6.1 High Vendor jar package name machinist Highest Vendor Manifest implementation-url http://github.com/typelevel/machinist Low Vendor Manifest Implementation-Vendor org.typelevel High Vendor Manifest Implementation-Vendor-Id org.typelevel Medium Vendor Manifest specification-vendor org.typelevel Low Vendor pom artifactid machinist_2.11 Highest Vendor pom artifactid machinist_2.11 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.typelevel Highest Vendor pom name machinist High Vendor pom organization name org.typelevel High Vendor pom organization url http://github.com/typelevel/machinist Medium Vendor pom url http://github.com/typelevel/machinist Highest Product file name machinist_2.11-0.6.1 High Product jar package name machinist Highest Product Manifest Implementation-Title machinist High Product Manifest implementation-url http://github.com/typelevel/machinist Low Product Manifest specification-title machinist Medium Product pom artifactid machinist_2.11 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.typelevel Highest Product pom name machinist High Product pom organization name org.typelevel Low Product pom organization url http://github.com/typelevel/machinist Low Product pom url http://github.com/typelevel/machinist Medium Version Manifest Implementation-Version 0.6.1 High Version pom version 0.6.1 Highest
Description:
machinist License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/typelevel/machinist_2.12/0.6.1/machinist_2.12-0.6.1.jar
MD5: 97c4e58e88ccfc3f0c2cd25a586120b0
SHA1: 13f7388cf36bcecf51bde7b87a216d5aa101ae2a
SHA256: fee6035ab2db522083775b2d97f192fc76bb7d4eed5151081e6933bf3da800e6
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name machinist_2.12-0.6.1 High Vendor jar package name machinist Highest Vendor Manifest implementation-url http://github.com/typelevel/machinist Low Vendor Manifest Implementation-Vendor org.typelevel High Vendor Manifest Implementation-Vendor-Id org.typelevel Medium Vendor Manifest specification-vendor org.typelevel Low Vendor pom artifactid machinist_2.12 Highest Vendor pom artifactid machinist_2.12 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.typelevel Highest Vendor pom name machinist High Vendor pom organization name org.typelevel High Vendor pom organization url http://github.com/typelevel/machinist Medium Vendor pom url http://github.com/typelevel/machinist Highest Product file name machinist_2.12-0.6.1 High Product jar package name machinist Highest Product Manifest Implementation-Title machinist High Product Manifest implementation-url http://github.com/typelevel/machinist Low Product Manifest specification-title machinist Medium Product pom artifactid machinist_2.12 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.typelevel Highest Product pom name machinist High Product pom organization name org.typelevel Low Product pom organization url http://github.com/typelevel/machinist Low Product pom url http://github.com/typelevel/machinist Medium Version Manifest Implementation-Version 0.6.1 High Version pom version 0.6.1 Highest
Description:
core License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/typelevel/macro-compat_2.11/1.1.1/macro-compat_2.11-1.1.1.jar
MD5: ee118c41bd4b59a558a3a158c9a49961
SHA1: 0cb87cb74fd5fb118fede3f98075c2044616b35d
SHA256: 5200a80ad392f0b882021d6de2efb17b874cc179ff8539f9bcedabc100b7890b
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name macro-compat_2.11-1.1.1 High Vendor Manifest implementation-url https://github.com/milessabin/macro-compat Low Vendor Manifest Implementation-Vendor org.typelevel High Vendor Manifest Implementation-Vendor-Id org.typelevel Medium Vendor Manifest specification-vendor org.typelevel Low Vendor pom artifactid macro-compat_2.11 Highest Vendor pom artifactid macro-compat_2.11 Low Vendor pom developer id milessabin Medium Vendor pom developer name Miles Sabin Medium Vendor pom groupid org.typelevel Highest Vendor pom name core High Vendor pom organization name org.typelevel High Vendor pom organization url milessabin/macro-compat Medium Vendor pom url milessabin/macro-compat Highest Product file name macro-compat_2.11-1.1.1 High Product Manifest Implementation-Title core High Product Manifest implementation-url https://github.com/milessabin/macro-compat Low Product Manifest specification-title core Medium Product pom artifactid macro-compat_2.11 Highest Product pom developer id milessabin Low Product pom developer name Miles Sabin Low Product pom groupid org.typelevel Highest Product pom name core High Product pom organization name org.typelevel Low Product pom url milessabin/macro-compat High Version Manifest Implementation-Version 1.1.1 High Version pom version 1.1.1 Highest
Description:
core License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/typelevel/macro-compat_2.12/1.1.1/macro-compat_2.12-1.1.1.jar
MD5: c6c8927e9d6b7e3e4f60c019f146d099
SHA1: ed809d26ef4237d7c079ae6cf7ebd0dfa7986adf
SHA256: 8b1514ec99ac9c7eded284367b6c9f8f17a097198a44e6f24488706d66bbd2b8
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name macro-compat_2.12-1.1.1 High Vendor Manifest implementation-url https://github.com/milessabin/macro-compat Low Vendor Manifest Implementation-Vendor org.typelevel High Vendor Manifest Implementation-Vendor-Id org.typelevel Medium Vendor Manifest specification-vendor org.typelevel Low Vendor pom artifactid macro-compat_2.12 Highest Vendor pom artifactid macro-compat_2.12 Low Vendor pom developer id milessabin Medium Vendor pom developer name Miles Sabin Medium Vendor pom groupid org.typelevel Highest Vendor pom name core High Vendor pom organization name org.typelevel High Vendor pom organization url milessabin/macro-compat Medium Vendor pom url milessabin/macro-compat Highest Product file name macro-compat_2.12-1.1.1 High Product Manifest Implementation-Title core High Product Manifest implementation-url https://github.com/milessabin/macro-compat Low Product Manifest specification-title core Medium Product pom artifactid macro-compat_2.12 Highest Product pom developer id milessabin Low Product pom developer name Miles Sabin Low Product pom groupid org.typelevel Highest Product pom name core High Product pom organization name org.typelevel Low Product pom url milessabin/macro-compat High Version Manifest Implementation-Version 1.1.1 High Version pom version 1.1.1 Highest
Description:
Metrics is a Java library which gives you unparalleled insight into what your code does in
production. Metrics provides a powerful toolkit of ways to measure the behavior of critical
components in your production environment.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-core/3.1.0/metrics-core-3.1.0.jar
MD5: 48e838f9753a2540cd5588466b20ec99
SHA1: 40e16d596ca49964a88bbce2261e387895b3499e
SHA256: d88845f17cd2c2d2203145e6f52e0c992cbe14d5887ddce97c9aceeae444b331
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name metrics-core High Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.core Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-core Highest Vendor pom artifactid metrics-core Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Metrics Core High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-core High Product jar package name metrics Highest Product Manifest Bundle-Name Metrics Core Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.core Medium Product Manifest Implementation-Title Metrics Core High Product pom artifactid metrics-core Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Metrics Core High Product pom parent-artifactid metrics-parent Medium Version file version 3.1.0 High Version Manifest Bundle-Version 3.1.0 High Version Manifest Implementation-Version 3.1.0 High Version pom version 3.1.0 Highest
Description:
A reporter for Metrics which announces measurements to a Graphite server.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-graphite/3.1.5/metrics-graphite-3.1.5.jar
MD5: 453a1877761c6a31a3892207b92f2b28
SHA1: 366b727fe0e64fe43b60a3e2455c9dcc149cc0d3
SHA256: af7401be256f2e91a3d799957fe8ac0a44407a6df098092a0f9e14feb5c899c5
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name metrics-graphite High Vendor jar package name graphite Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.graphite Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-graphite Highest Vendor pom artifactid metrics-graphite Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Graphite Integration for Metrics High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-graphite High Product jar package name graphite Highest Product jar package name metrics Highest Product Manifest Bundle-Name Graphite Integration for Metrics Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.graphite Medium Product Manifest Implementation-Title Graphite Integration for Metrics High Product pom artifactid metrics-graphite Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Graphite Integration for Metrics High Product pom parent-artifactid metrics-parent Medium Version file version 3.1.5 High Version Manifest Bundle-Version 3.1.5 High Version Manifest Implementation-Version 3.1.5 High Version pom version 3.1.5 Highest
Description:
An addition to Metrics which provides the ability to run application-specific health checks,
allowing you to check your application's heath in production.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-healthchecks/3.1.0/metrics-healthchecks-3.1.0.jar
MD5: f974d1ded236d33288ffd3cdbb778cee
SHA1: 475b277322856252b3e3d6b469140058c74dde0c
SHA256: 588afcd8d6e1e0a70b0919a3f3f3034eff4904729eeef510eb56d4d2442aeb4c
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name metrics-healthchecks High Vendor jar package name health Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.healthchecks Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-healthchecks Highest Vendor pom artifactid metrics-healthchecks Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Metrics Health Checks High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-healthchecks High Product jar package name health Highest Product jar package name metrics Highest Product Manifest Bundle-Name Metrics Health Checks Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.healthchecks Medium Product Manifest Implementation-Title Metrics Health Checks High Product pom artifactid metrics-healthchecks Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Metrics Health Checks High Product pom parent-artifactid metrics-parent Medium Version file version 3.1.0 High Version Manifest Bundle-Version 3.1.0 High Version Manifest Implementation-Version 3.1.0 High Version pom version 3.1.0 Highest
Description:
A set of Jackson modules which provide serializers for most Metrics classes.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-json/3.1.5/metrics-json-3.1.5.jar
MD5: fd717ba329eaddc4c2e1c1716728ed69
SHA1: 46debd1b9f1b4ada07d084dffc3eb272e87c6f62
SHA256: 2c7e7efa6cdf8d41f232eb2fe91f811f22675c36f9a7a711c66619bbafb3be96
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name metrics-json High Vendor jar package name json Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.json Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-json Highest Vendor pom artifactid metrics-json Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Jackson Integration for Metrics High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-json High Product jar package name json Highest Product jar package name metrics Highest Product Manifest Bundle-Name Jackson Integration for Metrics Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.json Medium Product Manifest Implementation-Title Jackson Integration for Metrics High Product pom artifactid metrics-json Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Jackson Integration for Metrics High Product pom parent-artifactid metrics-parent Medium Version file version 3.1.5 High Version Manifest Bundle-Version 3.1.5 High Version Manifest Implementation-Version 3.1.5 High Version pom version 3.1.5 Highest
Description:
A set of Jackson modules which provide serializers for most Metrics classes.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-json/3.2.3/metrics-json-3.2.3.jar
MD5: 95145a56f84bc13c78cc5b5b6f83b4d5
SHA1: c514ca9e836ed98e41bd16ed17098234a5c0a671
SHA256: 71103dadbe42a758fcec1dc374da604496216a1dea0f92a35befeb1ad707d0a8
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name metrics-json High Vendor jar package name json Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.json Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-json Highest Vendor pom artifactid metrics-json Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Jackson Integration for Metrics High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-json High Product jar package name json Highest Product jar package name metrics Highest Product Manifest Bundle-Name Jackson Integration for Metrics Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.json Medium Product Manifest Implementation-Title Jackson Integration for Metrics High Product pom artifactid metrics-json Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Jackson Integration for Metrics High Product pom parent-artifactid metrics-parent Medium Version file version 3.2.3 High Version Manifest Bundle-Version 3.2.3 High Version Manifest Implementation-Version 3.2.3 High Version pom version 3.2.3 Highest
Description:
A set of classes which allow you to monitor critical aspects of your Java Virtual Machine
using Metrics.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-jvm/3.1.5/metrics-jvm-3.1.5.jar
MD5: a35992ba955d3423678140941805db7b
SHA1: 042fe531a5873bd56dbca6e4b7678912b5df2a19
SHA256: 9e3eca426f5cf6187505406a94d3b0e380e323157409253f559c679e6db01704
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name metrics-jvm High Vendor jar package name jvm Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.jvm Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-jvm Highest Vendor pom artifactid metrics-jvm Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name JVM Integration for Metrics High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-jvm High Product jar package name jvm Highest Product jar package name metrics Highest Product Manifest Bundle-Name JVM Integration for Metrics Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.jvm Medium Product Manifest Implementation-Title JVM Integration for Metrics High Product pom artifactid metrics-jvm Highest Product pom groupid io.dropwizard.metrics Highest Product pom name JVM Integration for Metrics High Product pom parent-artifactid metrics-parent Medium Version file version 3.1.5 High Version Manifest Bundle-Version 3.1.5 High Version Manifest Implementation-Version 3.1.5 High Version pom version 3.1.5 Highest
Description:
A set of classes which allow you to monitor critical aspects of your Java Virtual Machine
using Metrics.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-jvm/3.2.3/metrics-jvm-3.2.3.jar
MD5: ee68dc5587733c66943cfe5d2ed3d843
SHA1: e7f47bc64cd226a61072c3b65a0d1265f13eae31
SHA256: e1cc65a0fde2a3ec9899ddeb46d8d2abc4d66d7dd24ade8444d640805a1c0dba
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name metrics-jvm High Vendor jar package name jvm Highest Vendor jar package name metrics Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.jvm Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-jvm Highest Vendor pom artifactid metrics-jvm Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name JVM Integration for Metrics High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-jvm High Product jar package name jvm Highest Product jar package name metrics Highest Product Manifest Bundle-Name JVM Integration for Metrics Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.jvm Medium Product Manifest Implementation-Title JVM Integration for Metrics High Product pom artifactid metrics-jvm Highest Product pom groupid io.dropwizard.metrics Highest Product pom name JVM Integration for Metrics High Product pom parent-artifactid metrics-parent Medium Version file version 3.2.3 High Version Manifest Bundle-Version 3.2.3 High Version Manifest Implementation-Version 3.2.3 High Version pom version 3.2.3 Highest
Description:
metrics-scala for Scala 2.11 License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/nl/grons/metrics-scala_2.11/3.5.9/metrics-scala_2.11-3.5.9.jar
MD5: 74d21a6fbb869047c25c94e997e90890
SHA1: 7509eddc11f278be0189d7fce8713dc658a81bd9
SHA256: dff4855392ebcbe58e6176e7d383e9ebd96c65de2c4e536fe53fffeaed54f6d4
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name metrics-scala_2.11-3.5.9 High Vendor jar package name grons Highest Vendor jar package name metrics Highest Vendor jar package name nl Highest Vendor jar package name scala Highest Vendor Manifest Implementation-Vendor nl.grons High Vendor Manifest Implementation-Vendor-Id nl.grons Medium Vendor Manifest specification-vendor nl.grons Low Vendor pom artifactid metrics-scala_2.11 Highest Vendor pom artifactid metrics-scala_2.11 Low Vendor pom developer name Brian Scully Medium Vendor pom developer name Erik van Oosten Medium Vendor pom groupid nl.grons Highest Vendor pom name metrics-scala High Vendor pom organization name nl.grons High Vendor pom url erikvanoosten/metrics-scala Highest Product file name metrics-scala_2.11-3.5.9 High Product jar package name grons Highest Product jar package name metrics Highest Product jar package name nl Highest Product jar package name scala Highest Product Manifest Implementation-Title metrics-scala High Product Manifest specification-title metrics-scala Medium Product pom artifactid metrics-scala_2.11 Highest Product pom developer name Brian Scully Low Product pom developer name Erik van Oosten Low Product pom groupid nl.grons Highest Product pom name metrics-scala High Product pom organization name nl.grons Low Product pom url erikvanoosten/metrics-scala High Version Manifest Implementation-Version 3.5.9 High Version pom version 3.5.9 Highest
Description:
An instrumented filter for servlet environments.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-servlet/3.2.3/metrics-servlet-3.2.3.jar
MD5: b2d0ea63b845c20eee1cc79ec37aa412
SHA1: 51a2ff777e8dc5122b8fc2e0fe99546e944c7852
SHA256: cdd0d79976f0d753b0e99e9362bc9c452477e63a832ee6d3a508f4e2c280d957
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name metrics-servlet High Vendor jar package name metrics Highest Vendor jar package name servlet Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.servlet Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-servlet Highest Vendor pom artifactid metrics-servlet Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Metrics Integration for Servlets High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-servlet High Product jar package name metrics Highest Product jar package name servlet Highest Product Manifest Bundle-Name Metrics Integration for Servlets Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.servlet Medium Product Manifest Implementation-Title Metrics Integration for Servlets High Product pom artifactid metrics-servlet Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Metrics Integration for Servlets High Product pom parent-artifactid metrics-parent Medium Version file version 3.2.3 High Version Manifest Bundle-Version 3.2.3 High Version Manifest Implementation-Version 3.2.3 High Version pom version 3.2.3 Highest
Description:
A set of utility servlets for Metrics, allowing you to expose valuable information about
your production environment.
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/io/dropwizard/metrics/metrics-servlets/3.2.3/metrics-servlets-3.2.3.jar
MD5: de7bb5604b8f997877908a1512a490ce
SHA1: 239216cfeff1c19c9c769e7a79eb96eaacb440b1
SHA256: eee5de553e4c4ce9f8dae787a26b280589472728f65b414cf41af9b4dbc8b9f6
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name metrics-servlets High Vendor jar package name metrics Highest Vendor jar package name servlets Highest Vendor Manifest bundle-symbolicname io.dropwizard.metrics.servlets Medium Vendor Manifest Implementation-Vendor-Id io.dropwizard.metrics Medium Vendor pom artifactid metrics-servlets Highest Vendor pom artifactid metrics-servlets Low Vendor pom groupid io.dropwizard.metrics Highest Vendor pom name Metrics Utility Servlets High Vendor pom parent-artifactid metrics-parent Low Product file name metrics-servlets High Product jar package name metrics Highest Product jar package name servlets Highest Product Manifest Bundle-Name Metrics Utility Servlets Medium Product Manifest bundle-symbolicname io.dropwizard.metrics.servlets Medium Product Manifest Implementation-Title Metrics Utility Servlets High Product pom artifactid metrics-servlets Highest Product pom groupid io.dropwizard.metrics Highest Product pom name Metrics Utility Servlets High Product pom parent-artifactid metrics-parent Medium Version file version 3.2.3 High Version Manifest Bundle-Version 3.2.3 High Version Manifest Implementation-Version 3.2.3 High Version pom version 3.2.3 Highest
Description:
mime-util is a simple to use, small, light weight and fast open source java utility library that can detect
MIME types from files, input streams, URL's and byte arrays.
Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/eu/medsea/mimeutil/mime-util/2.1.3/mime-util-2.1.3.jar
MD5: 3d4f3e1a96eb79683197f1c8b182f4a6
SHA1: 0c9cfae15c74f62491d4f28def0dff1dabe52a47
SHA256: 7512022ecd4228458a0ab456f9fcddac21f0759f1b07100c3528174eb63bdcaf
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name mime-util High Vendor jar package name eu Highest Vendor jar package name medsea Highest Vendor jar package name mimeutil Highest Vendor jar package name util Highest Vendor Manifest bundle-docurl http://www.medsea.eu Low Vendor Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium Vendor Manifest mode development Low Vendor Manifest url http://www.medsea.eu/mime-util/ Low Vendor pom artifactid mime-util Highest Vendor pom artifactid mime-util Low Vendor pom developer email nlmarco@users.sourceforge.net Low Vendor pom developer email smcardle@medsea.eu Low Vendor pom developer id nlmarco Medium Vendor pom developer id smcardle Medium Vendor pom developer name Marco Schulze Medium Vendor pom developer name Steven McArdle Medium Vendor pom developer org Medsea Business Solutions S.L. Medium Vendor pom developer org NightLabs GMBH Medium Vendor pom developer org URL http://www.nightlabs.de/nightlabs/html/ Medium Vendor pom groupid eu.medsea.mimeutil Highest Vendor pom name Mime Detection Utility High Vendor pom organization name Medsea Business Solutions S.L. High Vendor pom organization url http://www.medsea.eu Medium Vendor pom url http://www.medsea.eu/mime-util/ Highest Product file name mime-util High Product jar package name eu Highest Product jar package name medsea Highest Product jar package name mimeutil Highest Product jar package name util Highest Product Manifest bundle-docurl http://www.medsea.eu Low Product Manifest Bundle-Name Mime Detection Utility Medium Product Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium Product Manifest mode development Low Product Manifest url http://www.medsea.eu/mime-util/ Low Product pom artifactid mime-util Highest Product pom developer email nlmarco@users.sourceforge.net Low Product pom developer email smcardle@medsea.eu Low Product pom developer id nlmarco Low Product pom developer id smcardle Low Product pom developer name Marco Schulze Low Product pom developer name Steven McArdle Low Product pom developer org Medsea Business Solutions S.L. Low Product pom developer org NightLabs GMBH Low Product pom developer org URL http://www.nightlabs.de/nightlabs/html/ Low Product pom groupid eu.medsea.mimeutil Highest Product pom name Mime Detection Utility High Product pom organization name Medsea Business Solutions S.L. Low Product pom organization url http://www.medsea.eu Low Product pom url http://www.medsea.eu/mime-util/ Medium Version file version 2.1.3 High Version Manifest Bundle-Version 2.1.3 High Version pom version 2.1.3 Highest
Description:
Minimal overhead Java logging License:
New BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/com/esotericsoftware/minlog/1.3.0/minlog-1.3.0.jar
MD5: 5ab0ee168b90e0ad7010b159e603d304
SHA1: ff07b5f1b01d2f92bb00a337f9a94873712f0827
SHA256: f7b399d3a5478a4f3e0d98bd1c9f47766119c66414bc33aa0f6cde0066f24cc2
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-repl-parent:compile livy-test-lib:provided livy-client-common:compile livy-rsc:compile livy-api:provided livy-core-parent:compile livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name minlog High Vendor jar package name esotericsoftware Highest Vendor jar package name minlog Highest Vendor Manifest bundle-symbolicname com.esotericsoftware.minlog Medium Vendor Manifest Implementation-Vendor-Id com.esotericsoftware Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor pom artifactid minlog Highest Vendor pom artifactid minlog Low Vendor pom developer email nathan.sweet@gmail.com Low Vendor pom developer id nathan.sweet Medium Vendor pom developer name Nathan Sweet Medium Vendor pom groupid com.esotericsoftware Highest Vendor pom name MinLog High Vendor pom url EsotericSoftware/minlog Highest Product file name minlog High Product jar package name esotericsoftware Highest Product jar package name minlog Highest Product Manifest Bundle-Name MinLog Medium Product Manifest bundle-symbolicname com.esotericsoftware.minlog Medium Product Manifest Implementation-Title MinLog High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest specification-title MinLog Medium Product pom artifactid minlog Highest Product pom developer email nathan.sweet@gmail.com Low Product pom developer id nathan.sweet Low Product pom developer name Nathan Sweet Low Product pom groupid com.esotericsoftware Highest Product pom name MinLog High Product pom url EsotericSoftware/minlog High Version file version 1.3.0 High Version Manifest Bundle-Version 1.3.0 High Version Manifest Implementation-Version 1.3.0 High Version pom version 1.3.0 Highest
Description:
Mockito mock objects library core API and implementation License:
The MIT License: http://github.com/mockito/mockito/blob/master/LICENSE File Path: /root/.m2/repository/org/mockito/mockito-core/2.7.22/mockito-core-2.7.22.jar
MD5: 8e78b11e8c5fc86c3c563397f94b22d5
SHA1: fcf63bc8010ca77991e3cadd8d33ad1a40603404
SHA256: cd60ff78a3e51cc5e8d2fc5bb90e901f1b3a4d59e049b3e18386497b9fc12097
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name mockito-core High Vendor jar package name and Highest Vendor jar package name api Highest Vendor jar package name mockito Highest Vendor Manifest bundle-symbolicname org.mockito.mockito-core Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid mockito-core Highest Vendor pom artifactid mockito-core Low Vendor pom developer id bric3 Medium Vendor pom developer id raphw Medium Vendor pom developer id szczepiq Medium Vendor pom developer id TimvdLippe Medium Vendor pom developer name Brice Dutheil Medium Vendor pom developer name Rafael Winterhalter Medium Vendor pom developer name Szczepan Faber Medium Vendor pom developer name Tim van der Lippe Medium Vendor pom groupid org.mockito Highest Vendor pom name mockito-core High Vendor pom url http://mockito.org Highest Product file name mockito-core High Product jar package name and Highest Product jar package name api Highest Product jar package name mockito Highest Product Manifest Bundle-Name Mockito Mock Library for Java. Core bundle requires Byte Buddy and Objenesis. Medium Product Manifest bundle-symbolicname org.mockito.mockito-core Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid mockito-core Highest Product pom developer id bric3 Low Product pom developer id raphw Low Product pom developer id szczepiq Low Product pom developer id TimvdLippe Low Product pom developer name Brice Dutheil Low Product pom developer name Rafael Winterhalter Low Product pom developer name Szczepan Faber Low Product pom developer name Tim van der Lippe Low Product pom groupid org.mockito Highest Product pom name mockito-core High Product pom url http://mockito.org Medium Version file version 2.7.22 High Version Manifest Bundle-Version 2.7.22 High Version pom version 2.7.22 Highest
Description:
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/io/netty/netty/3.6.2.Final/netty-3.6.2.Final.jar
MD5: 65546c0885e83ba36f1f4d9ff9f8c776
SHA1: 69be11c61427f0604a30539755add84ad9e37e5e
SHA256: d4ff9f0a2959633e062edd0e678d8187bbe95ad19195384ac524fd41f00f5a44
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name netty High Vendor jar package name jboss Highest Vendor jar package name netty Highest Vendor Manifest bundle-buddypolicy registered Low Vendor Manifest bundle-docurl http://netty.io/ Low Vendor Manifest bundle-symbolicname org.jboss.netty Medium Vendor Manifest eclipse-buddypolicy registered Low Vendor pom artifactid netty Highest Vendor pom artifactid netty Low Vendor pom developer email netty@googlegroups.com Low Vendor pom developer id netty.io Medium Vendor pom developer name The Netty Project Contributors Medium Vendor pom developer org The Netty Project Medium Vendor pom developer org URL http://netty.io/ Medium Vendor pom groupid io.netty Highest Vendor pom name The Netty Project High Vendor pom organization name The Netty Project High Vendor pom organization url http://netty.io/ Medium Vendor pom url http://netty.io/ Highest Product file name netty High Product jar package name jboss Highest Product jar package name netty Highest Product jar package name socket Highest Product Manifest bundle-buddypolicy registered Low Product Manifest bundle-docurl http://netty.io/ Low Product Manifest Bundle-Name The Netty Project Medium Product Manifest bundle-symbolicname org.jboss.netty Medium Product Manifest eclipse-buddypolicy registered Low Product pom artifactid netty Highest Product pom developer email netty@googlegroups.com Low Product pom developer id netty.io Low Product pom developer name The Netty Project Contributors Low Product pom developer org The Netty Project Low Product pom developer org URL http://netty.io/ Low Product pom groupid io.netty Highest Product pom name The Netty Project High Product pom organization name The Netty Project Low Product pom organization url http://netty.io/ Low Product pom url http://netty.io/ Medium Version Manifest Bundle-Version 3.6.2.Final High Version pom version 3.6.2.Final Highest
CVE-2019-20444 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9866 MISC - https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20444] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20444 OSSIndex - https://github.com/netty/netty/issues/9866 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-20445 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9861 MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final MLIST - [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20445] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20445 OSSIndex - https://github.com/netty/netty/issues/9861 OSSIndex - https://github.com/netty/netty/pull/9865 OSSIndex - https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2015-2156 suppress
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-16869 suppress
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
BUGTRAQ - 20200105 [SECURITY] [DSA 4597-1] netty security update DEBIAN - DSA-4597 MISC - https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final MISC - https://github.com/netty/netty/issues/9571 MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 MLIST - [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 MLIST - [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty OSSINDEX - [CVE-2019-16869] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16869 OSSIndex - https://github.com/netty/netty/issues/9571 REDHAT - RHSA-2019:3892 REDHAT - RHSA-2019:3901 REDHAT - RHSA-2020:0159 REDHAT - RHSA-2020:0160 REDHAT - RHSA-2020:0161 REDHAT - RHSA-2020:0164 REDHAT - RHSA-2020:0445 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2021-37136 suppress
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37137 suppress
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-43797 suppress
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21295 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: LOW (2.6) Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
CONFIRM - https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj CONFIRM - https://security.netapp.com/advisory/ntap-20210604-0003/ DEBIAN - DSA-4885 MISC - https://github.com/Netflix/zuul/pull/980 MISC - https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 MISC - https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MLIST - [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final MLIST - [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) MLIST - [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 MLIST - [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 MLIST - [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 Vulnerable Software & Versions: (show all )
CVE-2021-21409 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21290 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-24823 suppress
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2014-0193 suppress
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames. CWE-399 Resource Management Errors
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
CVE-2014-3488 suppress
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
Description:
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/io/netty/netty/3.7.0.Final/netty-3.7.0.Final.jar
MD5: c9ef3b2f37d581e500a9d6c1efc4ab69
SHA1: 07a8c35599c68c0bf383df74469aa3e03d9aca87
SHA256: aa44be64442b9cbc5edd521476b9f1c272eec6a53dca104cf3032f42ad20ff89
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name netty High Vendor jar package name jboss Highest Vendor jar package name netty Highest Vendor Manifest bundle-buddypolicy registered Low Vendor Manifest bundle-docurl http://netty.io/ Low Vendor Manifest bundle-symbolicname org.jboss.netty Medium Vendor Manifest eclipse-buddypolicy registered Low Vendor pom artifactid netty Highest Vendor pom artifactid netty Low Vendor pom developer email netty@googlegroups.com Low Vendor pom developer id netty.io Medium Vendor pom developer name The Netty Project Contributors Medium Vendor pom developer org The Netty Project Medium Vendor pom developer org URL http://netty.io/ Medium Vendor pom groupid io.netty Highest Vendor pom name The Netty Project High Vendor pom organization name The Netty Project High Vendor pom organization url http://netty.io/ Medium Vendor pom url http://netty.io/ Highest Product file name netty High Product jar package name jboss Highest Product jar package name netty Highest Product jar package name socket Highest Product Manifest bundle-buddypolicy registered Low Product Manifest bundle-docurl http://netty.io/ Low Product Manifest Bundle-Name The Netty Project Medium Product Manifest bundle-symbolicname org.jboss.netty Medium Product Manifest eclipse-buddypolicy registered Low Product pom artifactid netty Highest Product pom developer email netty@googlegroups.com Low Product pom developer id netty.io Low Product pom developer name The Netty Project Contributors Low Product pom developer org The Netty Project Low Product pom developer org URL http://netty.io/ Low Product pom groupid io.netty Highest Product pom name The Netty Project High Product pom organization name The Netty Project Low Product pom organization url http://netty.io/ Low Product pom url http://netty.io/ Medium Version Manifest Bundle-Version 3.7.0.Final High Version pom version 3.7.0.Final Highest
CVE-2019-20444 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9866 MISC - https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20444] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20444 OSSIndex - https://github.com/netty/netty/issues/9866 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-20445 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9861 MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final MLIST - [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20445] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20445 OSSIndex - https://github.com/netty/netty/issues/9861 OSSIndex - https://github.com/netty/netty/pull/9865 OSSIndex - https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2015-2156 suppress
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-16869 suppress
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
BUGTRAQ - 20200105 [SECURITY] [DSA 4597-1] netty security update DEBIAN - DSA-4597 MISC - https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final MISC - https://github.com/netty/netty/issues/9571 MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 MLIST - [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 MLIST - [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty OSSINDEX - [CVE-2019-16869] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16869 OSSIndex - https://github.com/netty/netty/issues/9571 REDHAT - RHSA-2019:3892 REDHAT - RHSA-2019:3901 REDHAT - RHSA-2020:0159 REDHAT - RHSA-2020:0160 REDHAT - RHSA-2020:0161 REDHAT - RHSA-2020:0164 REDHAT - RHSA-2020:0445 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2021-37136 suppress
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37137 suppress
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-43797 suppress
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21295 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: LOW (2.6) Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
CONFIRM - https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj CONFIRM - https://security.netapp.com/advisory/ntap-20210604-0003/ DEBIAN - DSA-4885 MISC - https://github.com/Netflix/zuul/pull/980 MISC - https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 MISC - https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MLIST - [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final MLIST - [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) MLIST - [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 MLIST - [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 MLIST - [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 Vulnerable Software & Versions: (show all )
CVE-2021-21409 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21290 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-24823 suppress
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2014-0193 suppress
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames. CWE-399 Resource Management Errors
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
CVE-2014-3488 suppress
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
Description:
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/io/netty/netty/3.9.9.Final/netty-3.9.9.Final.jar
MD5: cff043f83e1e74a25819082405057517
SHA1: 58e0a7e7ff773f84d02d4f006ae9dd31ad22a0b1
SHA256: 697af248e216c9e158b3c9d6702f54541188fc92de19ac9d2f5496f80bce7aba
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name netty High Vendor jar package name jboss Highest Vendor jar package name netty Highest Vendor Manifest bundle-buddypolicy registered Low Vendor Manifest bundle-docurl http://netty.io/ Low Vendor Manifest bundle-symbolicname org.jboss.netty Medium Vendor Manifest eclipse-buddypolicy registered Low Vendor pom artifactid netty Highest Vendor pom artifactid netty Low Vendor pom developer email netty@googlegroups.com Low Vendor pom developer id netty.io Medium Vendor pom developer name The Netty Project Contributors Medium Vendor pom developer org The Netty Project Medium Vendor pom developer org URL http://netty.io/ Medium Vendor pom groupid io.netty Highest Vendor pom name Netty High Vendor pom organization name The Netty Project High Vendor pom organization url http://netty.io/ Medium Vendor pom url http://netty.io/ Highest Product file name netty High Product jar package name jboss Highest Product jar package name netty Highest Product jar package name socket Highest Product Manifest bundle-buddypolicy registered Low Product Manifest bundle-docurl http://netty.io/ Low Product Manifest Bundle-Name Netty Medium Product Manifest bundle-symbolicname org.jboss.netty Medium Product Manifest eclipse-buddypolicy registered Low Product pom artifactid netty Highest Product pom developer email netty@googlegroups.com Low Product pom developer id netty.io Low Product pom developer name The Netty Project Contributors Low Product pom developer org The Netty Project Low Product pom developer org URL http://netty.io/ Low Product pom groupid io.netty Highest Product pom name Netty High Product pom organization name The Netty Project Low Product pom organization url http://netty.io/ Low Product pom url http://netty.io/ Medium Version Manifest Bundle-Version 3.9.9.Final High Version pom version 3.9.9.Final Highest
CVE-2019-20444 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9866 MISC - https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20444] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20444 OSSIndex - https://github.com/netty/netty/issues/9866 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-20445 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9861 MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final MLIST - [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20445] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20445 OSSIndex - https://github.com/netty/netty/issues/9861 OSSIndex - https://github.com/netty/netty/pull/9865 OSSIndex - https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-16869 suppress
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
BUGTRAQ - 20200105 [SECURITY] [DSA 4597-1] netty security update DEBIAN - DSA-4597 MISC - https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final MISC - https://github.com/netty/netty/issues/9571 MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 MLIST - [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 MLIST - [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty OSSINDEX - [CVE-2019-16869] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16869 OSSIndex - https://github.com/netty/netty/issues/9571 REDHAT - RHSA-2019:3892 REDHAT - RHSA-2019:3901 REDHAT - RHSA-2020:0159 REDHAT - RHSA-2020:0160 REDHAT - RHSA-2020:0161 REDHAT - RHSA-2020:0164 REDHAT - RHSA-2020:0445 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2021-37136 suppress
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37137 suppress
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-43797 suppress
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21295 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: LOW (2.6) Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
CONFIRM - https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj CONFIRM - https://security.netapp.com/advisory/ntap-20210604-0003/ DEBIAN - DSA-4885 MISC - https://github.com/Netflix/zuul/pull/980 MISC - https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 MISC - https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MLIST - [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final MLIST - [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) MLIST - [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 MLIST - [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 MLIST - [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 Vulnerable Software & Versions: (show all )
CVE-2021-21409 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21290 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-24823 suppress
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
File Path: /root/.m2/repository/io/netty/netty-all/4.1.17.Final/netty-all-4.1.17.Final.jarMD5: 34863f57beeb33c6a7e0cc1e355a73d4SHA1: 43142cd1d6a0ea281eb6a4990354b4d3ad23dd43SHA256: 578f39b27617662a69ad84cd3793f506f6350cbd75ae87e8e686f5e7bdd5161cReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl-parent:provided livy-test-lib:provided livy-rsc:compile livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name netty-all High Vendor jar package name io Highest Vendor jar package name netty Highest Vendor Manifest implementation-url http://netty.io/netty-all/ Low Vendor Manifest Implementation-Vendor The Netty Project High Vendor Manifest Implementation-Vendor-Id io.netty Medium Vendor pom artifactid netty-all Highest Vendor pom artifactid netty-all Low Vendor pom groupid io.netty Highest Vendor pom name Netty/All-in-One High Vendor pom parent-artifactid netty-parent Low Product file name netty-all High Product jar package name io Highest Product jar package name netty Highest Product Manifest Implementation-Title Netty/All-in-One High Product Manifest implementation-url http://netty.io/netty-all/ Low Product pom artifactid netty-all Highest Product pom groupid io.netty Highest Product pom name Netty/All-in-One High Product pom parent-artifactid netty-parent Medium Version Manifest Implementation-Version 4.1.17.Final High Version pom version 4.1.17.Final Highest
CVE-2019-20444 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9866 MISC - https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20444] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20444 OSSIndex - https://github.com/netty/netty/issues/9866 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-20445 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9861 MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final MLIST - [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 OSSINDEX - [CVE-2019-20445] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20445 OSSIndex - https://github.com/netty/netty/issues/9861 OSSIndex - https://github.com/netty/netty/pull/9865 OSSIndex - https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-16869 suppress
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
BUGTRAQ - 20200105 [SECURITY] [DSA 4597-1] netty security update DEBIAN - DSA-4597 MISC - https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final MISC - https://github.com/netty/netty/issues/9571 MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 MLIST - [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 MLIST - [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty REDHAT - RHSA-2019:3892 REDHAT - RHSA-2019:3901 REDHAT - RHSA-2020:0159 REDHAT - RHSA-2020:0160 REDHAT - RHSA-2020:0161 REDHAT - RHSA-2020:0164 REDHAT - RHSA-2020:0445 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-9518 (OSSINDEX)suppress
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:io.netty:netty-all:4.1.17.Final:*:*:*:*:*:*:* CVE-2020-11612 suppress
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-7238 (OSSINDEX)suppress
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:/C:N/I:H/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:io.netty:netty-all:4.1.17.Final:*:*:*:*:*:*:* CVE-2021-37136 suppress
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37137 suppress
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-43797 suppress
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21295 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: LOW (2.6) Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
CONFIRM - https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj CONFIRM - https://security.netapp.com/advisory/ntap-20210604-0003/ DEBIAN - DSA-4885 MISC - https://github.com/Netflix/zuul/pull/980 MISC - https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 MISC - https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MLIST - [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final MLIST - [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) MLIST - [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 MLIST - [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 MLIST - [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 Vulnerable Software & Versions: (show all )
CVE-2021-21409 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21290 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-24823 suppress
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Java Concurrency Tools Core Library License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/io/netty/netty-common/4.1.36.Final/netty-common-4.1.36.Final.jar/META-INF/maven/org.jctools/jctools-core/pom.xml
MD5: d532029de01ef1c790266dea91b1ecdc
SHA1: f9571c65e428d21c795a34de2b217419dfc0e2f7
SHA256: db8f1cd5b23d38e3dcf7020d739e1c2f9559489051291d8a07095e62b8d7f750
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor pom artifactid jctools-core Low Vendor pom groupid org.jctools Highest Vendor pom name Java Concurrency Tools Core Library High Vendor pom url JCTools Highest Product pom artifactid jctools-core Highest Product pom groupid org.jctools Highest Product pom name Java Concurrency Tools Core Library High Product pom url JCTools High Version pom version 2.1.1 Highest
Description:
Reactive streams implementation for Netty. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/typesafe/netty/netty-reactive-streams/2.0.3/netty-reactive-streams-2.0.3.jar
MD5: febb0012a726e2c1e7ba36ba6e0eb7ff
SHA1: be61d6a731ba66a998c22d96439621716bc30f79
SHA256: dd66261c22d2d19141e5be03909faa3d8fab5cd75b1a799ccc1344f11627f921
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name netty-reactive-streams High Vendor jar package name netty Highest Vendor jar package name typesafe Highest Vendor Manifest automatic-module-name com.typesafe.netty.core Medium Vendor Manifest bundle-docurl http://typesafe.com/ Low Vendor Manifest bundle-symbolicname com.typesafe.netty.reactive-streams Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom artifactid netty-reactive-streams Highest Vendor pom artifactid netty-reactive-streams Low Vendor pom groupid com.typesafe.netty Highest Vendor pom name Netty Reactive Streams Implementation High Vendor pom parent-artifactid netty-reactive-streams-parent Low Product file name netty-reactive-streams High Product jar package name netty Highest Product jar package name typesafe Highest Product Manifest automatic-module-name com.typesafe.netty.core Medium Product Manifest bundle-docurl http://typesafe.com/ Low Product Manifest Bundle-Name Netty Reactive Streams Implementation Medium Product Manifest bundle-symbolicname com.typesafe.netty.reactive-streams Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product pom artifactid netty-reactive-streams Highest Product pom groupid com.typesafe.netty Highest Product pom name Netty Reactive Streams Implementation High Product pom parent-artifactid netty-reactive-streams-parent Medium Version file version 2.0.3 High Version Manifest Bundle-Version 2.0.3 High Version pom version 2.0.3 Highest
Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. License:
http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/io/netty/netty-transport/4.1.36.Final/netty-transport-4.1.36.Final.jar
MD5: 99a444ea18d22bde04e6e4d1fe1446b5
SHA1: 8546e6be47be587acab86bbd106ca023678f07d9
SHA256: eaaf9464f0b1b7e9bb02918598aa78718436e3974b7ffd39f6c6b893200fc5a1
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name netty-transport High Vendor jar package name io Highest Vendor jar package name netty Highest Vendor Manifest automatic-module-name io.netty.transport Medium Vendor Manifest bundle-docurl http://netty.io/ Low Vendor Manifest bundle-symbolicname io.netty.transport Medium Vendor Manifest implementation-url http://netty.io/netty-transport/ Low Vendor Manifest Implementation-Vendor The Netty Project High Vendor Manifest Implementation-Vendor-Id io.netty Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid netty-transport Highest Vendor pom artifactid netty-transport Low Vendor pom groupid io.netty Highest Vendor pom name Netty/Transport High Vendor pom parent-artifactid netty-parent Low Product file name netty-transport High Product jar package name io Highest Product jar package name netty Highest Product Manifest automatic-module-name io.netty.transport Medium Product Manifest bundle-docurl http://netty.io/ Low Product Manifest Bundle-Name Netty/Transport Medium Product Manifest bundle-symbolicname io.netty.transport Medium Product Manifest Implementation-Title Netty/Transport High Product Manifest implementation-url http://netty.io/netty-transport/ Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid netty-transport Highest Product pom groupid io.netty Highest Product pom name Netty/Transport High Product pom parent-artifactid netty-parent Medium Version Manifest Bundle-Version 4.1.36.Final High Version Manifest Implementation-Version 4.1.36.Final High Version pom version 4.1.36.Final Highest
Related Dependencies netty-buffer-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-buffer/4.1.36.Final/netty-buffer-4.1.36.Final.jar MD5: 666e79767f59134440d008c575841372 SHA1: 7f2db0921dd57df4db076229830ab09bba713aeb SHA256: 170008cc1867e590c7a8fbbd21f99afe36c7aac0cdd1dcbf6ff1a440a44cc911 pkg:maven/io.netty/netty-buffer@4.1.36.Final netty-codec-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-codec/4.1.36.Final/netty-codec-4.1.36.Final.jar MD5: b9b6a6a8a96f59b3c609bfaf5a23de2f SHA1: 8462116d327bb3d1ec24258071f2e7345a73dbfc SHA256: 7ec5258c301acaa31166514f2751842b90f6395e1adae0d7caa451dd2588ef8b pkg:maven/io.netty/netty-codec@4.1.36.Final netty-codec-dns-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-codec-dns/4.1.36.Final/netty-codec-dns-4.1.36.Final.jar MD5: 6b50f9eef30102216b6ec3f980a864d5 SHA1: 8775964a38d6e5d2847c98fc91a91486665b1dcc SHA256: 86937eec72cc68050588a45490164ef373178b5e03052568bef254db3489b161 pkg:maven/io.netty/netty-codec-dns@4.1.36.Final netty-codec-http-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-codec-http/4.1.36.Final/netty-codec-http-4.1.36.Final.jar MD5: d2ee2f18ed802c598e08de89d95efccc SHA1: 62b73d439dbddf3c0dde092b048580139695ab46 SHA256: ba886bc7450326e62fefcd541d0425fcb3e8b271e49c70aa8327f1075abf4722 pkg:maven/io.netty/netty-codec-http@4.1.36.Final netty-codec-socks-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-codec-socks/4.1.36.Final/netty-codec-socks-4.1.36.Final.jar MD5: ddae56ec128c77050ce3b0a8de1d435a SHA1: 054bedfd0bec809898d5b8ff9cb9f3f9e427e967 SHA256: 233971c392bef9baba454813c222476ffb4ba60331ff3146fb71af28f983a8fd pkg:maven/io.netty/netty-codec-socks@4.1.36.Final netty-common-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-common/4.1.36.Final/netty-common-4.1.36.Final.jar MD5: ef68e7b4fea6b3c1da712266a4a3f73c SHA1: f6f38fde652a70ea579897edc80e52353e487ae6 SHA256: 2a81446c17a056f4036478a0f4e5ff4bf9e53d78b29b8cd2f7534bf186fdcf11 pkg:maven/io.netty/netty-common@4.1.36.Final netty-handler-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-handler/4.1.36.Final/netty-handler-4.1.36.Final.jar MD5: 39a89e1725b3b0bd5e8cfb4b778a5bb4 SHA1: 1c38a5920a10c01b1cce4cdc964447ec76abf1b5 SHA256: deeb81a51fc44b0dc7cec19cb1538061c96c227516ccda23e28b9b5dcc51626b pkg:maven/io.netty/netty-handler@4.1.36.Final netty-handler-proxy-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-handler-proxy/4.1.36.Final/netty-handler-proxy-4.1.36.Final.jar MD5: 52207647a83c429a8a21e567ab511c20 SHA1: f313f45db4417cd8a87c49b8cb01faf19f6abdec SHA256: d992ca091c19523f2a9b826b377207ca8352b43650fb38fbae7c037a7634ab5f pkg:maven/io.netty/netty-handler-proxy@4.1.36.Final netty-resolver-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-resolver/4.1.36.Final/netty-resolver-4.1.36.Final.jar MD5: bc4587a7dcb91009e5034f018ea6b392 SHA1: e4d243fbf4e6837fa294f892bf97149e18129100 SHA256: 5f5ec10beaef4c04a2954027d7109012706b6083bbdbd78f8a6b5e25967833bc pkg:maven/io.netty/netty-resolver@4.1.36.Final netty-resolver-dns-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-resolver-dns/4.1.36.Final/netty-resolver-dns-4.1.36.Final.jar MD5: 32839b9d34d473baeb9afd7d4a2233e1 SHA1: 071f0d061465651d90c7f1d40a66580f69821582 SHA256: 9776a17aa393f9c77c0e67e1041fe9a2f2234e4bb26015c8cd5be401b8e57179 pkg:maven/io.netty/netty-resolver-dns@4.1.36.Final netty-transport-native-epoll-4.1.36.Final-linux-x86_64.jarFile Path: /root/.m2/repository/io/netty/netty-transport-native-epoll/4.1.36.Final/netty-transport-native-epoll-4.1.36.Final-linux-x86_64.jar MD5: 66a89a5183440402bb3652f044a132e1 SHA1: 8ec8e248ef34b86cc7fae023fb40b9ffa8f5614f SHA256: a48da8559c524fb03ccb3bd3ca5a7e7e62b34322907b4c341206b13192b12fa7 pkg:maven/io.netty/netty-transport-native-epoll@4.1.36.Final netty-transport-native-unix-common-4.1.36.Final.jarFile Path: /root/.m2/repository/io/netty/netty-transport-native-unix-common/4.1.36.Final/netty-transport-native-unix-common-4.1.36.Final.jar MD5: 6e129de247357c454fd4d2ca936495e5 SHA1: d95d7033f400f9472db9da7834c443b96cd4bab0 SHA256: 3571129b0d491e9e26df1dd67df015da856ce648994b48f7f83fa44d099bc28c pkg:maven/io.netty/netty-transport-native-unix-common@4.1.36.Final CVE-2019-20444 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9866 MISC - https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 MLIST - [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-20445 suppress
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
DEBIAN - DSA-4885 FEDORA - FEDORA-2020-66b5f85ccc MISC - https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final MISC - https://github.com/netty/netty/issues/9861 MISC - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E MLIST - [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 MLIST - [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 MLIST - [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 MLIST - [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities MLIST - [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 MLIST - [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final MLIST - [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 MLIST - [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 MLIST - [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 REDHAT - RHSA-2020:0497 REDHAT - RHSA-2020:0567 REDHAT - RHSA-2020:0601 REDHAT - RHSA-2020:0605 REDHAT - RHSA-2020:0606 REDHAT - RHSA-2020:0804 REDHAT - RHSA-2020:0805 REDHAT - RHSA-2020:0806 REDHAT - RHSA-2020:0811 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2019-16869 suppress
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
BUGTRAQ - 20200105 [SECURITY] [DSA 4597-1] netty security update DEBIAN - DSA-4597 MISC - https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final MISC - https://github.com/netty/netty/issues/9571 MLIST - [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 MLIST - [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities MLIST - [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 MLIST - [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty MLIST - [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 MLIST - [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update MLIST - [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update MLIST - [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities MLIST - [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 MLIST - [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, MLIST - [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 MLIST - [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty MLIST - [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list MLIST - [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 MLIST - [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 MLIST - [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 MLIST - [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 MLIST - [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 MLIST - [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 MLIST - [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty MLIST - [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty REDHAT - RHSA-2019:3892 REDHAT - RHSA-2019:3901 REDHAT - RHSA-2020:0159 REDHAT - RHSA-2020:0160 REDHAT - RHSA-2020:0161 REDHAT - RHSA-2020:0164 REDHAT - RHSA-2020:0445 UBUNTU - USN-4532-1 Vulnerable Software & Versions: (show all )
CVE-2020-11612 suppress
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37136 suppress
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-37137 suppress
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-43797 suppress
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21295 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: LOW (2.6) Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
CONFIRM - https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj CONFIRM - https://security.netapp.com/advisory/ntap-20210604-0003/ DEBIAN - DSA-4885 MISC - https://github.com/Netflix/zuul/pull/980 MISC - https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 MISC - https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E MISC - https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E MISC - https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MLIST - [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final MLIST - [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx MLIST - [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) MLIST - [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 MLIST - [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 MLIST - [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 MLIST - [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 MLIST - [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 MLIST - [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 MLIST - [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 Vulnerable Software & Versions: (show all )
CVE-2021-21409 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-21290 suppress
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-24823 suppress
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere
CVSSv2:
Base Score: LOW (1.9) Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
A library for instantiating Java objects License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/objenesis/objenesis/2.5.1/objenesis-2.5.1.jar
MD5: 84b9e3191629e53abbb05a92c683c617
SHA1: 272bab9a4e5994757044d1fc43ce480c8cb907a4
SHA256: b043f03e466752f7f03e2326a3b13a49b7c649f8f2a2dc87715827e24f73d9c6
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-repl-parent:compile livy-test-lib:provided livy-client-common:compile livy-rsc:compile livy-api:provided livy-core-parent:compile livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-core_2.11:compile livy-core_2.12:compile livy-examples:compile livy-client-http:compile Evidence Type Source Name Value Confidence Vendor file name objenesis High Vendor jar package name objenesis Highest Vendor Manifest bundle-symbolicname org.objenesis Medium Vendor Manifest implementation-url http://objenesis.org Low Vendor Manifest Implementation-Vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita High Vendor Manifest Implementation-Vendor-Id org.objenesis Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor Manifest specification-vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita Low Vendor pom artifactid objenesis Highest Vendor pom artifactid objenesis Low Vendor pom groupid org.objenesis Highest Vendor pom name Objenesis High Vendor pom parent-artifactid objenesis-parent Low Vendor pom url http://objenesis.org Highest Product file name objenesis High Product jar package name objenesis Highest Product Manifest Bundle-Name Objenesis Medium Product Manifest bundle-symbolicname org.objenesis Medium Product Manifest Implementation-Title Objenesis High Product Manifest implementation-url http://objenesis.org Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest specification-title Objenesis Medium Product pom artifactid objenesis Highest Product pom groupid org.objenesis Highest Product pom name Objenesis High Product pom parent-artifactid objenesis-parent Medium Product pom url http://objenesis.org Medium Version file version 2.5.1 High Version Manifest Bundle-Version 2.5.1 High Version Manifest Implementation-Version 2.5.1 High Version pom version 2.5.1 Highest
Description:
A library for instantiating Java objects License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/objenesis/objenesis/2.5/objenesis-2.5.jar
MD5: 65daddc231144b94cd66e7962e04e391
SHA1: 612ecb799912ccf77cba9b3ed8c813da086076e9
SHA256: 293328e1b0d31ed30bb89fca542b6c52fac00989bb0e62eb9d98d630c4dd6b7c
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name objenesis High Vendor jar package name objenesis Highest Vendor Manifest bundle-symbolicname org.objenesis Medium Vendor Manifest implementation-url http://objenesis.org Low Vendor Manifest Implementation-Vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita High Vendor Manifest Implementation-Vendor-Id org.objenesis Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor Manifest specification-vendor Joe Walnes, Henri Tremblay, Leonardo Mesquita Low Vendor pom artifactid objenesis Highest Vendor pom artifactid objenesis Low Vendor pom groupid org.objenesis Highest Vendor pom name Objenesis High Vendor pom parent-artifactid objenesis-parent Low Vendor pom url http://objenesis.org Highest Product file name objenesis High Product jar package name objenesis Highest Product Manifest Bundle-Name Objenesis Medium Product Manifest bundle-symbolicname org.objenesis Medium Product Manifest Implementation-Title Objenesis High Product Manifest implementation-url http://objenesis.org Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest specification-title Objenesis Medium Product pom artifactid objenesis Highest Product pom groupid org.objenesis Highest Product pom name Objenesis High Product pom parent-artifactid objenesis-parent Medium Product pom url http://objenesis.org Medium Version file version 2.5 High Version Manifest Implementation-Version 2.5 High Version pom version 2.5 Highest
Description:
A simple library for reading and writing CSV in Java License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/net/sf/opencsv/opencsv/2.3/opencsv-2.3.jar
MD5: 9eebabaa007dc329845e5ab3c12b4e6b
SHA1: c23708cdb9e80a144db433e23344a788a1fd6599
SHA256: dc0ba5bff6140dc92339973026a0ecbddc2a3b01bdd46ed9d16becc2f6d78de6
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name opencsv High Vendor jar package name au Low Vendor jar package name bytecode Low Vendor jar package name com Low Vendor jar package name opencsv Highest Vendor pom artifactid opencsv Highest Vendor pom artifactid opencsv Low Vendor pom developer email glen_a_smith@users.sourceforge.net Low Vendor pom developer email sconway@users.sourceforge.net Low Vendor pom developer email sullis@users.sourceforge.net Low Vendor pom developer id glen-smith Medium Vendor pom developer id scott_conway Medium Vendor pom developer id sean-sullivan Medium Vendor pom developer name Glen Smith Medium Vendor pom developer name Scott Conway Medium Vendor pom developer name Sean Sullivan Medium Vendor pom groupid net.sf.opencsv Highest Vendor pom name opencsv High Vendor pom url http://opencsv.sf.net Highest Product file name opencsv High Product jar package name bytecode Low Product jar package name com Low Product jar package name opencsv Highest Product jar package name opencsv Low Product pom artifactid opencsv Highest Product pom developer email glen_a_smith@users.sourceforge.net Low Product pom developer email sconway@users.sourceforge.net Low Product pom developer email sullis@users.sourceforge.net Low Product pom developer id glen-smith Low Product pom developer id scott_conway Low Product pom developer id sean-sullivan Low Product pom developer name Glen Smith Low Product pom developer name Scott Conway Low Product pom developer name Sean Sullivan Low Product pom groupid net.sf.opencsv Highest Product pom name opencsv High Product pom url http://opencsv.sf.net Medium Version file version 2.3 High Version pom version 2.3 Highest
File Path: /root/.m2/repository/org/apache/orc/orc-core/1.5.5/orc-core-1.5.5-nohive.jar/META-INF/maven/org.apache.hive/hive-storage-api/pom.xmlMD5: bdb5d6de24941146e492df6bde461a4dSHA1: 5e493551e9a147fb3fdab0181a948a1791531c54SHA256: a0cf80e31e42e8fe3d22aedb56b02f019c71eee314fca4f2afd4dd6b911ee761Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid hive-storage-api Low Vendor pom groupid org.apache.hive Highest Vendor pom name Hive Storage API High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Product pom artifactid hive-storage-api Highest Product pom groupid org.apache.hive Highest Product pom name Hive Storage API High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Version pom parent-version 2.6.0 Low Version pom version 2.6.0 Highest
Related Dependencies orc-mapreduce-1.5.5-nohive.jar (shaded: org.apache.hive:hive-storage-api:2.6.0)File Path: /root/.m2/repository/org/apache/orc/orc-mapreduce/1.5.5/orc-mapreduce-1.5.5-nohive.jar/META-INF/maven/org.apache.hive/hive-storage-api/pom.xml MD5: bdb5d6de24941146e492df6bde461a4d SHA1: 5e493551e9a147fb3fdab0181a948a1791531c54 SHA256: a0cf80e31e42e8fe3d22aedb56b02f019c71eee314fca4f2afd4dd6b911ee761 pkg:maven/org.apache.hive/hive-storage-api@2.6.0 CVE-2021-4125 suppress
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-34538 suppress
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. CWE-306 Missing Authentication for Critical Function
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
Description:
The core reader and writer for ORC files. Uses the vectorized column batch
for the in memory representation.
File Path: /root/.m2/repository/org/apache/orc/orc-core/1.5.5/orc-core-1.5.5-nohive.jarMD5: 607fa8be42c6687aaaab3adf80136501SHA1: 031c4c6c741a558d68c76c4cf88fb06fdca82adcSHA256: 1ed6d28ff4880021a00e2fe9410483f0cf68e5731e53d13dc9290f77f92587b4Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name orc-core High Vendor jar package name apache Highest Vendor jar package name orc Highest Vendor jar package name reader Highest Vendor jar package name writer Highest Vendor Manifest implementation-url http://orc.apache.org/orc-core Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.orc Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid orc-core Highest Vendor pom artifactid orc-core Low Vendor pom groupid org.apache.orc Highest Vendor pom name ORC Core High Vendor pom parent-artifactid orc Low Product file name orc-core High Product jar package name apache Highest Product jar package name orc Highest Product jar package name reader Highest Product jar package name writer Highest Product Manifest Implementation-Title ORC Core High Product Manifest implementation-url http://orc.apache.org/orc-core Low Product Manifest specification-title ORC Core Medium Product pom artifactid orc-core Highest Product pom groupid org.apache.orc Highest Product pom name ORC Core High Product pom parent-artifactid orc Medium Version file version 1.5.5 High Version Manifest Implementation-Version 1.5.5 High Version pom version 1.5.5 Highest
Related Dependencies orc-mapreduce-1.5.5-nohive.jarFile Path: /root/.m2/repository/org/apache/orc/orc-mapreduce/1.5.5/orc-mapreduce-1.5.5-nohive.jar MD5: dc9c26f6f2877b3d6a4ed411831242a0 SHA1: fc8c58a4bd3a3523e42eec3eee61810e92ab6fe4 SHA256: 76e12481247f25ee62a43fbf43720b5fc9e500fe1573cc53578ebb4816591363 pkg:maven/org.apache.orc/orc-mapreduce@1.5.5 orc-shims-1.5.5.jarFile Path: /root/.m2/repository/org/apache/orc/orc-shims/1.5.5/orc-shims-1.5.5.jar MD5: cf1715fc2e8bbb4b3fe3706f46404661 SHA1: 6a639c228ab66601398fd2d94d441d4c6a9a7c8e SHA256: 577751984af6d2cd68d47c094c094e545155569e54d81ef7e59fb3c88889ea71 pkg:maven/org.apache.orc/orc-shims@1.5.5 Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/api/pom.xml
Referenced In Projects/Scopes: livy-core-parent livy-repl_2.11 livy-coverage-report livy-test-lib livy-scala-api-parent livy-core_2.12 livy-scala-api_2.11 livy-client-common livy-integration-test livy-core_2.11 livy-scala-api_2.12 livy-repl-parent livy-client-http livy-repl_2.12 livy-assembly livy-rsc livy-server livy-examples Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-api Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-api Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/client-common/pom.xml
Referenced In Projects/Scopes: livy-core-parent livy-repl_2.11 livy-coverage-report livy-core_2.12 livy-integration-test livy-core_2.11 livy-repl-parent livy-client-http livy-repl_2.12 livy-assembly livy-rsc livy-server livy-examples Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-client-common Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-client-common Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/client-http/pom.xml
Referenced In Projects/Scopes: livy-coverage-report livy-examples Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-client-http Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-client-http Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/core/scala-2.11/pom.xml
Referenced In Projects/Scopes: livy-integration-test livy-repl-parent livy-repl_2.11 livy-coverage-report livy-assembly livy-rsc livy-server Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-core_2.11 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-core_2.11 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/core/scala-2.12/pom.xml
Referenced In Projects/Scopes: livy-coverage-report livy-repl_2.12 livy-assembly Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-core_2.12 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-core_2.12 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/repl/scala-2.11/pom.xml
Referenced In Projects/Scopes: livy-coverage-report livy-assembly Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-repl_2.11 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-repl_2.11 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/repl/scala-2.12/pom.xml
Referenced In Projects/Scopes: livy-coverage-report livy-assembly Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-repl_2.12 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-repl_2.12 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/rsc/pom.xml
Referenced In Projects/Scopes: livy-integration-test livy-repl-parent livy-repl_2.11 livy-coverage-report livy-repl_2.12 livy-assembly livy-server Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-rsc Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-rsc Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/scala-api/scala-2.11/pom.xml
Referenced In Projects/Scopes: livy-coverage-report livy-examples Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-scala-api_2.11 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-scala-api_2.11 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/scala-api/scala-2.12/pom.xml
Referenced In Project/Scope: livy-coverage-report
Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-scala-api_2.12 Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-scala-api_2.12 Highest Product project groupid org.apache.livy Low
Description:
Livy Project License:
The Apache Software License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /workspace/server/pom.xml
Referenced In Projects/Scopes: livy-integration-test livy-coverage-report livy-assembly Evidence Type Source Name Value Confidence Vendor file name pom High Vendor project artifactid livy-server Low Vendor project groupid org.apache.livy Highest Product file name pom High Product project artifactid livy-server Highest Product project groupid org.apache.livy Low
File Path: /root/.m2/repository/oro/oro/2.0.8/oro-2.0.8.jarMD5: 42e940d5d2d822f4dc04c65053e630abSHA1: 5592374f834645c4ae250f4c9fbb314c9369d698SHA256: e00ccdad5df7eb43fdee44232ef64602bf63807c2d133a7be83ba09fd49af26eReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name oro High Vendor jar package name apache Highest Vendor jar package name oro Highest Vendor manifest: org/apache/oro Implementation-Vendor Apache Software Foundation Medium Vendor pom artifactid oro Highest Vendor pom artifactid oro Low Vendor pom groupid oro Highest Product file name oro High Product jar package name apache Highest Product jar package name oro Highest Product manifest: org/apache/oro Implementation-Title org.apache.oro Medium Product manifest: org/apache/oro Specification-Title Jakarta ORO Medium Product pom artifactid oro Highest Product pom groupid oro Highest Version file version 2.0.8 High Version pom version 2.0.8 Highest
Description:
See http://wiki.glassfish.java.net/Wiki.jsp?page=JdkSpiOsgi for more information License:
https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html File Path: /root/.m2/repository/org/glassfish/hk2/osgi-resource-locator/1.0.1/osgi-resource-locator-1.0.1.jar
MD5: 51e70ad8fc9d1e9fb19debeb55555b75
SHA1: 4ed2b2d4738aed5786cfa64cba5a332779c4c708
SHA256: 775003be577e8806f51b6e442be1033d83be2cb2207227b349be0bf16e6c0843
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name osgi-resource-locator High Vendor jar package name glassfish Highest Vendor jar package name hk2 Highest Vendor Manifest bundle-activationpolicy lazy Low Vendor Manifest bundle-docurl https://glassfish.dev.java.net Low Vendor Manifest bundle-symbolicname org.glassfish.hk2.osgi-resource-locator Medium Vendor pom artifactid osgi-resource-locator Highest Vendor pom artifactid osgi-resource-locator Low Vendor pom developer id ss141213 Medium Vendor pom developer name Sahoo Medium Vendor pom developer org Sun Microsystems, Inc. Medium Vendor pom groupid org.glassfish.hk2 Highest Vendor pom name OSGi resource locator bundle - used by various API providers that rely on META-INF/services mechanism to locate providers. High Vendor pom parent-artifactid pom Low Vendor pom parent-groupid org.glassfish Medium Product file name osgi-resource-locator High Product jar package name glassfish Highest Product jar package name hk2 Highest Product Manifest bundle-activationpolicy lazy Low Product Manifest bundle-docurl https://glassfish.dev.java.net Low Product Manifest Bundle-Name OSGi resource locator bundle - used by various API providers that rely on META-INF/services mechanism to locate providers. Medium Product Manifest bundle-symbolicname org.glassfish.hk2.osgi-resource-locator Medium Product pom artifactid osgi-resource-locator Highest Product pom developer id ss141213 Low Product pom developer name Sahoo Low Product pom developer org Sun Microsystems, Inc. Low Product pom groupid org.glassfish.hk2 Highest Product pom name OSGi resource locator bundle - used by various API providers that rely on META-INF/services mechanism to locate providers. High Product pom parent-artifactid pom Medium Product pom parent-groupid org.glassfish Medium Version file version 1.0.1 High Version Manifest Bundle-Version 1.0.1 High Version pom parent-version 1.0.1 Low Version pom version 1.0.1 Highest
Description:
Paranamer allows runtime access to constructor and method parameter names for Java classes License:
LICENSE.txt File Path: /root/.m2/repository/com/thoughtworks/paranamer/paranamer/2.8/paranamer-2.8.jar
MD5: f213c72b67d4850f17a4a3e9064904de
SHA1: 619eba74c19ccf1da8ebec97a2d7f8ba05773dd6
SHA256: 688cb118a6021d819138e855208c956031688be4b47a24bb615becc63acedf07
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:compile livy-test-lib:provided livy-api:provided livy-repl_2.11:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile livy-server:compile livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name paranamer High Vendor jar package name paranamer Highest Vendor jar package name thoughtworks Highest Vendor Manifest bundle-symbolicname com.thoughtworks.paranamer Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor pom artifactid paranamer Highest Vendor pom artifactid paranamer Low Vendor pom groupid com.thoughtworks.paranamer Highest Vendor pom name ParaNamer Core High Vendor pom parent-artifactid paranamer-parent Low Product file name paranamer High Product jar package name paranamer Highest Product jar package name thoughtworks Highest Product Manifest Bundle-Name ParaNamer Core Medium Product Manifest bundle-symbolicname com.thoughtworks.paranamer Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product pom artifactid paranamer Highest Product pom groupid com.thoughtworks.paranamer Highest Product pom name ParaNamer Core High Product pom parent-artifactid paranamer-parent Medium Version file version 2.8 High Version pom version 2.8 Highest
File Path: /root/.m2/repository/org/apache/parquet/parquet-column/1.10.1/parquet-column-1.10.1.jarMD5: 1f9dd05a9c588c54bd6fb7512de28240SHA1: 10999fbe40cd5d26e7e800a9cf8e6cc0fcf1c99eSHA256: 7f60ce075164dca7ff2bb91ee4248bb1f319052924e21b1ce45f2f11f9ebd9e5Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name parquet-column High Vendor jar package name apache Highest Vendor jar package name column Highest Vendor jar package name parquet Highest Vendor Manifest git-sha-1 a89df8f9932b6ef6633d06069e50c9b7970bebd1 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.parquet Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid parquet-column Highest Vendor pom artifactid parquet-column Low Vendor pom groupid org.apache.parquet Highest Vendor pom name Apache Parquet Column High Vendor pom parent-artifactid parquet Low Vendor pom url https://parquet.apache.org Highest Product file name parquet-column High Product hint analyzer product parquet-mr High Product jar package name apache Highest Product jar package name column Highest Product jar package name parquet Highest Product Manifest git-sha-1 a89df8f9932b6ef6633d06069e50c9b7970bebd1 Low Product Manifest Implementation-Title Apache Parquet Column High Product Manifest specification-title Apache Parquet Column Medium Product pom artifactid parquet-column Highest Product pom groupid org.apache.parquet Highest Product pom name Apache Parquet Column High Product pom parent-artifactid parquet Medium Product pom url https://parquet.apache.org Medium Version file version 1.10.1 High Version Manifest Implementation-Version 1.10.1 High Version pom version 1.10.1 Highest
Related Dependencies parquet-common-1.10.1.jarFile Path: /root/.m2/repository/org/apache/parquet/parquet-common/1.10.1/parquet-common-1.10.1.jar MD5: 150a1dd63e6ecc2773313b5b874739c8 SHA1: 2a6b665654098c2321f7ab95c48096734026638d SHA256: 0be41811f8439dc080570048af6c43fdbcd18e5c9a7efaebf28ba7c96771d99e pkg:maven/org.apache.parquet/parquet-common@1.10.1 parquet-encoding-1.10.1.jarFile Path: /root/.m2/repository/org/apache/parquet/parquet-encoding/1.10.1/parquet-encoding-1.10.1.jar MD5: abe8be70da3436d72d97595470ec7d48 SHA1: b495a7817b434be694965059c0cd4c255a94c57d SHA256: 59148af75275ad318f97e90f873b7d77c7040b332a11133d4587e3a59dabe25f pkg:maven/org.apache.parquet/parquet-encoding@1.10.1 parquet-hadoop-1.10.1.jarFile Path: /root/.m2/repository/org/apache/parquet/parquet-hadoop/1.10.1/parquet-hadoop-1.10.1.jar MD5: 9836550a739f2448169300e07489261b SHA1: 374c8d94b49388266aeb4d96ae2d19e6fe957b26 SHA256: 2e11a94294be801ae83e10d8958afd5e60d61e7a4a57a0b3674d68ad5c99a73e pkg:maven/org.apache.parquet/parquet-hadoop@1.10.1 parquet-jackson-1.10.1.jarFile Path: /root/.m2/repository/org/apache/parquet/parquet-jackson/1.10.1/parquet-jackson-1.10.1.jar MD5: 1d83df16a9306173069f2a36a99bfbfd SHA1: d61d80ada3a2c6b0c9ed06bd689cfd428de96112 SHA256: 9bc44323cf3a36bfb1ab197f5b8f2b13a3a2613baa0489bb252b33553562a528 pkg:maven/org.apache.parquet/parquet-jackson@1.10.1 CVE-2021-41561 suppress
Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Parquet is a columnar storage format that supports nested data. This provides all generated metadata code. License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/parquet/parquet-format/2.4.0/parquet-format-2.4.0.jar
MD5: 694f51066294bd941a3f24fe870ec9f6
SHA1: d4508d385899dfb2dcecdc08fc5e4a5e6b747057
SHA256: de350bcac7b69af274db38ffe4892ab64291dbe1c66fdbec1fb5ef3ef8b98efa
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name parquet-format High Vendor jar package name apache Highest Vendor jar package name format Highest Vendor jar package name org Highest Vendor jar package name parquet Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.parquet Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid parquet-format Highest Vendor pom artifactid parquet-format Low Vendor pom developer email julien@twitter.com Low Vendor pom developer email nong@cloudera.com Low Vendor pom developer name Julien Le Dem Medium Vendor pom developer name Nong Li Medium Vendor pom groupid org.apache.parquet Highest Vendor pom name Apache Parquet Format High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://parquet.apache.org/ Highest Product file name parquet-format High Product jar package name apache Highest Product jar package name format Highest Product jar package name org Highest Product jar package name parquet Highest Product Manifest Implementation-Title Apache Parquet Format High Product Manifest specification-title Apache Parquet Format Medium Product pom artifactid parquet-format Highest Product pom developer email julien@twitter.com Low Product pom developer email nong@cloudera.com Low Product pom developer name Julien Le Dem Low Product pom developer name Nong Li Low Product pom groupid org.apache.parquet Highest Product pom name Apache Parquet Format High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://parquet.apache.org/ Medium Version file version 2.4.0 High Version Manifest Implementation-Version 2.4.0 High Version pom parent-version 2.4.0 Low Version pom version 2.4.0 Highest
File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-column/pom.xmlMD5: 0b96517e31ca064f1b7f698a85fda8b7SHA1: b708d7cb139d5ac965150841a8238e5755478c9bSHA256: c6282b0cca120757f402e1501f1da75b5695ea70704479daa87ce925a0d62133Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid parquet-column Low Vendor pom groupid com.twitter Highest Vendor pom name Apache Parquet Column (Incubating) High Vendor pom parent-artifactid parquet Low Vendor pom url https://parquet.incubator.apache.org Highest Product hint analyzer product parquet-mr High Product pom artifactid parquet-column Highest Product pom groupid com.twitter Highest Product pom name Apache Parquet Column (Incubating) High Product pom parent-artifactid parquet Medium Product pom url https://parquet.incubator.apache.org Medium Version pom version 1.6.0 Highest
Related Dependencies parquet-hadoop-bundle-1.6.0.jar (shaded: com.twitter:parquet-common:1.6.0)File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-common/pom.xml MD5: 11338fac15d6a381f084fd4076f39100 SHA1: 0fc01328884acf7665c5951abbcae32a19d23fad SHA256: 8d32d93e94136da4faf08f744baaa20782002826e7d4b9cf472af52a0761a430 pkg:maven/com.twitter/parquet-common@1.6.0 parquet-hadoop-bundle-1.6.0.jar (shaded: com.twitter:parquet-encoding:1.6.0)File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-encoding/pom.xml MD5: 5cf0876a669109bb9b74ae0b1dfc1089 SHA1: ede1706eb8ff8daedd9d0e2fc74b63ea28d55440 SHA256: be42a70f9939502b134703b18977407b6d2ef43a35d69bc0318f4d50528409c6 pkg:maven/com.twitter/parquet-encoding@1.6.0 parquet-hadoop-bundle-1.6.0.jar (shaded: com.twitter:parquet-generator:1.6.0)File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-generator/pom.xml MD5: 54c87806af9e4b43636a1a227d3ae4cd SHA1: 9c8bfd2c9a1c107b6cd9fd85a93a335b81b31674 SHA256: f4f095774b827f15289c04bce0050bb968f3f5e29149611cf75ce622f0f1185c pkg:maven/com.twitter/parquet-generator@1.6.0 parquet-hadoop-bundle-1.6.0.jar (shaded: com.twitter:parquet-jackson:1.6.0)File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-jackson/pom.xml MD5: b3ab3ce7fe35ce02e58c17f862c4b7e7 SHA1: 864e9c578e73f28eec8bcd5ff86589998e037d9d SHA256: d6ab2eb5f9f814b27a4635dcd4ef063dfe8340b1434ec12f3d2e226df39de6f0 pkg:maven/com.twitter/parquet-jackson@1.6.0 CVE-2021-41561 suppress
Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Parquet is a columnar storage format that supports nested data. This provides all generated metadata code. License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/com.twitter/parquet-format/pom.xml
MD5: 55d1df47887cc578e0897e5125df1fa5
SHA1: 268f5420adf2e8cd42881fcf5ad83493a8cc7f69
SHA256: 50b96fa214f911048b30e4382813322d8f1cd7149aba746625da76f2558a5d18
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid parquet-format Low Vendor pom developer email julien@twitter.com Low Vendor pom developer email nong@cloudera.com Low Vendor pom developer name Julien Le Dem Medium Vendor pom developer name Nong Li Medium Vendor pom groupid com.twitter Highest Vendor pom name Apache Parquet Format (Incubating) High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://parquet.incubator.apache.org/ Highest Product pom artifactid parquet-format Highest Product pom developer email julien@twitter.com Low Product pom developer email nong@cloudera.com Low Product pom developer name Julien Le Dem Low Product pom developer name Nong Li Low Product pom groupid com.twitter Highest Product pom name Apache Parquet Format (Incubating) High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://parquet.incubator.apache.org/ Medium Version pom parent-version 2.2.0-rc1 Low Version pom version 2.2.0-rc1 Highest
Description:
The slf4j API File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jar/META-INF/maven/org.slf4j/slf4j-api/pom.xmlMD5: 71f03f1293831ab1462ab5436b1e9ca3SHA1: 3fceb45ce8f7a6f87f3f2077a24a3833d1ecb4c6SHA256: 2eaca71afe0a1516f4abd8e9ff907838d268f38c81c3a542cce8d7f3b87c5d4cReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid slf4j-api Low Vendor pom groupid org.slf4j Highest Vendor pom name SLF4J API Module High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product pom artifactid slf4j-api Highest Product pom groupid org.slf4j Highest Product pom name SLF4J API Module High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version pom version 1.7.2 Highest
File Path: /root/.m2/repository/com/twitter/parquet-hadoop-bundle/1.6.0/parquet-hadoop-bundle-1.6.0.jarMD5: f8ddd880590e8e1a239e3c54c8eebc18SHA1: b5ac7d2781de212c84420962723093cd17cefd72SHA256: 2016abf10040c5eb7b4ff1f4b922d13121f1438199ee8eb85341c7ba1816cedcReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name parquet-hadoop-bundle High Vendor jar package name apache Highest Vendor jar package name hadoop Highest Vendor jar package name parquet Highest Vendor Manifest git-sha-1 6aa21f8776625b5fa6b18059cfebe7549f2e00cb Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id com.twitter Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid parquet-hadoop Low Vendor pom artifactid parquet-hadoop-bundle Highest Vendor pom artifactid parquet-hadoop-bundle Low Vendor pom groupid com.twitter Highest Vendor pom name Apache Parquet Hadoop (Incubating) High Vendor pom name Apache Parquet Hadoop Bundle (Incubating) High Vendor pom parent-artifactid parquet Low Vendor pom url https://parquet.incubator.apache.org Highest Product file name parquet-hadoop-bundle High Product hint analyzer product parquet-mr High Product jar package name apache Highest Product jar package name hadoop Highest Product jar package name parquet Highest Product Manifest git-sha-1 6aa21f8776625b5fa6b18059cfebe7549f2e00cb Low Product Manifest Implementation-Title Apache Parquet Hadoop Bundle (Incubating) High Product Manifest specification-title Apache Parquet Hadoop Bundle (Incubating) Medium Product pom artifactid parquet-hadoop Highest Product pom artifactid parquet-hadoop-bundle Highest Product pom groupid com.twitter Highest Product pom name Apache Parquet Hadoop (Incubating) High Product pom name Apache Parquet Hadoop Bundle (Incubating) High Product pom parent-artifactid parquet Medium Product pom url https://parquet.incubator.apache.org Medium Version file version 1.6.0 High Version Manifest Implementation-Version 1.6.0 High Version pom version 1.6.0 Highest
CVE-2022-26612 suppress
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-41561 suppress
Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-3162 suppress
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0. CWE-20 Improper Input Validation
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L References:
Vulnerable Software & Versions:
CVE-2017-3161 suppress
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions:
CVE-2016-5001 suppress
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. CWE-200 Information Exposure
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
A pure-java implementation of the twitter/util project's `CpuProfile` and related classes. License:
The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/papertrail/profiler/1.0.2/profiler-1.0.2.jar
MD5: b6cb78e7d8a5c4ed1ad259afc4f7c793
SHA1: 138093a4ed2da6f0b07a2a2335584bd5a7d53bff
SHA256: 188ec41349472a0c50fbe7e4cdcc6d6c8968ad6cd9047effeaa6a5c111f9074d
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name profiler High Vendor jar package name cpuprofile Highest Vendor jar package name papertrail Highest Vendor jar package name papertrail Low Vendor jar package name profiler Highest Vendor jar package name profiler Low Vendor pom artifactid profiler Highest Vendor pom artifactid profiler Low Vendor pom developer email jared@librato.com Low Vendor pom developer name Jared Harper Medium Vendor pom developer org Papertrail, Inc. Medium Vendor pom developer org URL http://www.papertrailapp.com Medium Vendor pom groupid com.papertrail Highest Vendor pom url papertrail/profiler Highest Product file name profiler High Product jar package name cpuprofile Highest Product jar package name papertrail Highest Product jar package name profiler Highest Product jar package name profiler Low Product pom artifactid profiler Highest Product pom developer email jared@librato.com Low Product pom developer name Jared Harper Low Product pom developer org Papertrail, Inc. Low Product pom developer org URL http://www.papertrailapp.com Low Product pom groupid com.papertrail Highest Product pom url papertrail/profiler High Version file version 1.0.2 High Version pom version 1.0.2 Highest
Description:
Protocol Buffers are a way of encoding structured data in an efficient yet
extensible format.
License:
New BSD license: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/com/google/protobuf/protobuf-java/2.5.0/protobuf-java-2.5.0.jar
MD5: a44473b98947e2a54c54e0db1387d137
SHA1: a10732c76bfacdbd633a7eb0f7968b1059a65dfa
SHA256: e0c1c64575c005601725e7c6a02cebf9e1285e888f756b2a1d73ffa8d725cc74
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name protobuf-java High Vendor jar package name google Highest Vendor jar package name protobuf Highest Vendor Manifest bundle-docurl http://code.google.com/p/protobuf Low Vendor Manifest bundle-symbolicname com.google.protobuf Medium Vendor pom artifactid protobuf-java Highest Vendor pom artifactid protobuf-java Low Vendor pom groupid com.google.protobuf Highest Vendor pom name Protocol Buffer Java API High Vendor pom parent-artifactid google Low Vendor pom parent-groupid com.google Medium Vendor pom url http://code.google.com/p/protobuf Highest Product file name protobuf-java High Product jar package name google Highest Product jar package name protobuf Highest Product Manifest bundle-docurl http://code.google.com/p/protobuf Low Product Manifest Bundle-Name Protocol Buffer Java API Medium Product Manifest bundle-symbolicname com.google.protobuf Medium Product pom artifactid protobuf-java Highest Product pom groupid com.google.protobuf Highest Product pom name Protocol Buffer Java API High Product pom parent-artifactid google Medium Product pom parent-groupid com.google Medium Product pom url http://code.google.com/p/protobuf Medium Version file version 2.5.0 High Version Manifest Bundle-Version 2.5.0 High Version pom parent-version 2.5.0 Low Version pom version 2.5.0 Highest
Related Dependencies hive-exec-1.2.1.spark2.jar (shaded: com.google.protobuf:protobuf-java:2.5.0)File Path: /root/.m2/repository/org/spark-project/hive/hive-exec/1.2.1.spark2/hive-exec-1.2.1.spark2.jar/META-INF/maven/com.google.protobuf/protobuf-java/pom.xml MD5: 8f761580cb2cdc4f13e82c1368f99e5e SHA1: d0b411e81d63761989f1329e8650ef27f6f77d25 SHA256: 9d837a52af87aa417ca14aeec39d0eae34f3fe58aae5e36397e6f0e12d5d4f47 pkg:maven/com.google.protobuf/protobuf-java@2.5.0 orc-mapreduce-1.5.5-nohive.jar (shaded: com.google.protobuf:protobuf-java:2.5.0)File Path: /root/.m2/repository/org/apache/orc/orc-mapreduce/1.5.5/orc-mapreduce-1.5.5-nohive.jar/META-INF/maven/com.google.protobuf/protobuf-java/pom.xml MD5: 8f761580cb2cdc4f13e82c1368f99e5e SHA1: d0b411e81d63761989f1329e8650ef27f6f77d25 SHA256: 9d837a52af87aa417ca14aeec39d0eae34f3fe58aae5e36397e6f0e12d5d4f47 pkg:maven/com.google.protobuf/protobuf-java@2.5.0 CVE-2022-3171 suppress
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above. NVD-CWE-noinfo
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-3509 (OSSINDEX)suppress
protobuf-java - Denial of Service (DoS) CWE-20 Improper Input Validation
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:com.google.protobuf:protobuf-java:2.5.0:*:*:*:*:*:*:* CVE-2021-22569 suppress
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions. NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
Py4J enables Python programs running in a Python interpreter to dynamically access Java objects in a Java Virtual Machine. Methods are called as if the Java objects resided in the Python interpreter and Java collections can be accessed through standard Python collection methods. Py4J also enables Java programs to call back Python objects. License:
The New BSD License: http://www.opensource.org/licenses/bsd-license.html File Path: /root/.m2/repository/net/sf/py4j/py4j/0.10.7/py4j-0.10.7.jar
MD5: 51552359047812808cde255ef38e78d2
SHA1: e733e888c2e798ea15802f12a9f3130949ca741f
SHA256: 49d1e3e86532a6c68c399fb83508603ebeeb9b942e0cf301db71c7987fd4dfcb
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name py4j High Vendor jar package name py4j Highest Vendor jar package name py4j Low Vendor pom artifactid py4j Highest Vendor pom artifactid py4j Low Vendor pom developer id bartdag Medium Vendor pom developer name Barthelemy Dagenais Medium Vendor pom groupid net.sf.py4j Highest Vendor pom name Py4J High Product file name py4j High Product jar package name py4j Highest Product pom artifactid py4j Highest Product pom developer id bartdag Low Product pom developer name Barthelemy Dagenais Low Product pom groupid net.sf.py4j Highest Product pom name Py4J High Version file version 0.10.7 High Version pom version 0.10.7 Highest
Description:
This library allows your Java program to interface very easily with the Python world. It uses the Pyro protocol to call methods on remote objects. (See https://github.com/irmen/Pyro4). To that end, it also contains and uses a feature complete pickle protocol implementation -read and write- to exchange data with Pyro/Python.
Pyrolite only implements part of the client side Pyro library, hence its name 'lite'... But because Pyrolite has no dependencies, it is a much lighter way to use Pyro from Java/.NET than a solution with jython+pyro or IronPython+Pyro would provide. So if you don't need Pyro's full feature set, and don't require your Java/.NET code to host Pyro objects itself, Pyrolite may be a good choice to connect java or .NET and python.
Version 4.13 can now register a custom pickler for inheritance tree of interfaces or abstract base class. License:
MIT License: https://raw.githubusercontent.com/irmen/Pyrolite/master/LICENSE File Path: /root/.m2/repository/net/razorvine/pyrolite/4.13/pyrolite-4.13.jar
MD5: b4ab074cb07e995bcbd203c72e5efa1d
SHA1: b71a4668b0c4194486832fe7ce161eed2d0d12cb
SHA256: 4ba424d328cbd7a6ff73108cce40d3cc376eef602b947e57fdc782171d92e463
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name pyrolite High Vendor jar package name net Highest Vendor jar package name net Low Vendor jar package name objects Highest Vendor jar package name pickle Low Vendor jar package name pyro Highest Vendor jar package name razorvine Highest Vendor jar package name razorvine Low Vendor pom artifactid pyrolite Highest Vendor pom artifactid pyrolite Low Vendor pom developer email irmen@razorvine.net Low Vendor pom developer id irmen Medium Vendor pom developer name Irmen de Jong Medium Vendor pom groupid net.razorvine Highest Vendor pom name pyrolite High Vendor pom url irmen/Pyrolite Highest Product file name pyrolite High Product jar package name net Highest Product jar package name objects Highest Product jar package name pickle Low Product jar package name pyro Highest Product jar package name razorvine Highest Product jar package name razorvine Low Product pom artifactid pyrolite Highest Product pom developer email irmen@razorvine.net Low Product pom developer id irmen Low Product pom developer name Irmen de Jong Low Product pom groupid net.razorvine Highest Product pom name pyrolite High Product pom url irmen/Pyrolite High Version file version 4.13 High Version pom version 4.13 Highest
Description:
A Protocol for Asynchronous Non-Blocking Data Sequence License:
CC0: http://creativecommons.org/publicdomain/zero/1.0/ File Path: /root/.m2/repository/org/reactivestreams/reactive-streams/1.0.2/reactive-streams-1.0.2.jar
MD5: 022ff8ca0101daeb35c8df9b120ff99e
SHA1: 323964c36556eb0e6209f65c1cef72b53b461ab8
SHA256: cc09ab0b140e0d0496c2165d4b32ce24f4d6446c0a26c5dc77b06bdf99ee8fae
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name reactive-streams High Vendor jar package name reactivestreams Highest Vendor Manifest automatic-module-name org.reactivestreams Medium Vendor Manifest bundle-docurl http://reactive-streams.org Low Vendor Manifest bundle-symbolicname org.reactivestreams.reactive-streams Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid reactive-streams Highest Vendor pom artifactid reactive-streams Low Vendor pom developer id reactive-streams-sig Medium Vendor pom developer name Reactive Streams SIG Medium Vendor pom groupid org.reactivestreams Highest Vendor pom name reactive-streams High Vendor pom url http://www.reactive-streams.org/ Highest Product file name reactive-streams High Product jar package name reactivestreams Highest Product Manifest automatic-module-name org.reactivestreams Medium Product Manifest bundle-docurl http://reactive-streams.org Low Product Manifest Bundle-Name reactive-streams Medium Product Manifest bundle-symbolicname org.reactivestreams.reactive-streams Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid reactive-streams Highest Product pom developer id reactive-streams-sig Low Product pom developer name Reactive Streams SIG Low Product pom groupid org.reactivestreams Highest Product pom name reactive-streams High Product pom url http://www.reactive-streams.org/ Medium Version file version 1.0.2 High Version Manifest Bundle-Version 1.0.2 High Version pom version 1.0.2 Highest
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/META-INF/maven/jline/jline/pom.xml
MD5: 6f323a86fb397559d2a3b40149062a14
SHA1: ce2bf8d2c9c41583d06dff1be46268c39d8f5ee5
SHA256: 289f90f55140af99a74cd6c20234f0dc6130463484a2ed5744035825ee3568aa
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor pom artifactid jline Low Vendor pom developer email gnodet@gmail.com Low Vendor pom developer email jason@planet57.com Low Vendor pom developer email mprudhom@gmail.com Low Vendor pom developer id gnodet Medium Vendor pom developer id jdillon Medium Vendor pom developer id mprudhom Medium Vendor pom developer name Guillaume Nodet Medium Vendor pom developer name Jason Dillon Medium Vendor pom developer name Marc Prud'hommeaux Medium Vendor pom groupid jline Highest Vendor pom name JLine High Product pom artifactid jline Highest Product pom developer email gnodet@gmail.com Low Product pom developer email jason@planet57.com Low Product pom developer email mprudhom@gmail.com Low Product pom developer id gnodet Low Product pom developer id jdillon Low Product pom developer id mprudhom Low Product pom developer name Guillaume Nodet Low Product pom developer name Jason Dillon Low Product pom developer name Marc Prud'hommeaux Low Product pom groupid jline Highest Product pom name JLine High Version pom version 2.14.3 Highest
Description:
Compiler for the Scala Programming Language License:
BSD 3-Clause: http://www.scala-lang.org/license.html File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar
MD5: a014622503fb7c4326ee84ce7a01c490
SHA1: a1b5e58fd80cb1edc1413e904a346bfdb3a88333
SHA256: 3e892546b72ab547cb77de4d840bcfd05c853e73390fed7370a8f19acb0735a0
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name scala-compiler High Vendor jar package name compiler Highest Vendor jar package name scala Highest Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.6, JavaSE-1.7 Low Vendor Manifest bundle-symbolicname org.scala-lang.scala-compiler Medium Vendor pom artifactid scala-compiler Highest Vendor pom artifactid scala-compiler Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name EPFL LAMP Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang Highest Vendor pom name Scala Compiler High Vendor pom organization name LAMP/EPFL High Vendor pom organization url http://lamp.epfl.ch/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-compiler High Product jar package name compiler Highest Product jar package name scala Highest Product Manifest Bundle-Name Scala Compiler Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.6, JavaSE-1.7 Low Product Manifest bundle-symbolicname org.scala-lang.scala-compiler Medium Product pom artifactid scala-compiler Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name EPFL LAMP Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang Highest Product pom name Scala Compiler High Product pom organization name LAMP/EPFL Low Product pom organization url http://lamp.epfl.ch/ Low Product pom url http://www.scala-lang.org/ Medium Version file version 2.11.12 High Version pom version 2.11.12 Highest
CVE-2012-6708 (OSSINDEX)suppress
JQuery - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (6.1) Vector: /AV:N/AC:L/Au:/C:L/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.scala-lang:scala-compiler:2.11.12:*:*:*:*:*:*:* CVE-2015-9251 (OSSINDEX)suppress
jQuery - Cross-Site Scripting (XSS) [CVE-2015-9251]
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.scala-lang:scala-compiler:2.11.12:*:*:*:*:*:*:* CVE-2019-11358 (OSSINDEX)suppress
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CWE-1321
CVSSv2:
Base Score: MEDIUM (6.1) Vector: /AV:N/AC:L/Au:/C:L/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.scala-lang:scala-compiler:2.11.12:*:*:*:*:*:*:* CVE-2020-11023 (OSSINDEX)suppress
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (6.1) Vector: /AV:N/AC:L/Au:/C:L/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.scala-lang:scala-compiler:2.11.12:*:*:*:*:*:*:* CVE-2020-7656 (OSSINDEX)suppress
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (6.1) Vector: /AV:N/AC:L/Au:/C:L/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.scala-lang:scala-compiler:2.11.12:*:*:*:*:*:*:* File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/diagrams.jsMD5: d848f67d1c7a1ca4bb026499648f7c3bSHA1: a061d967fc0094d407fc7a25a9825570997b0a6cSHA256: f5c001406ea4d8b88a301d33cf5841869d8c2a9d127853416d0b0df01a6fcefaReferenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/index.jsMD5: 22daf0417dcd85260677dda1ea258731SHA1: 23b1437de3bf73140ddbf0346899f0c475efc568SHA256: 2bfe4678308bf8b4b96a3385a5e85b0c0a799087e1a9af9183c5d4cf2c852108Referenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/META-INF/native/windows32/jansi.dllMD5: 83fdcbb296f9732176748e443c7637a5SHA1: f91fda2c7f9f485db21a50c05ff3a65c1fa20090SHA256: 7db0fdba01b93f8d45c8fa9ba949f424efb0361d6f8af5561d769378d8b3a1acReferenced In Projects/Scopes:
livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jansi High Product file name jansi High
Related Dependencies scala-compiler-2.12.10.jar: jansi.dllFile Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/META-INF/native/windows32/jansi.dll MD5: 83fdcbb296f9732176748e443c7637a5 SHA1: f91fda2c7f9f485db21a50c05ff3a65c1fa20090 SHA256: 7db0fdba01b93f8d45c8fa9ba949f424efb0361d6f8af5561d769378d8b3a1ac File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/META-INF/native/windows64/jansi.dllMD5: b009262ec2c7e84839af9729b752f14eSHA1: 8d96f40da8970ddd48af4517512a0fdd077c33daSHA256: daed7ea5b66bce3821742564af812b6f4e25939b3d273ed5a156ba7c92c452dcReferenced In Projects/Scopes:
livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jansi High Product file name jansi High
Related Dependencies scala-compiler-2.12.10.jar: jansi.dllFile Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/META-INF/native/windows64/jansi.dll MD5: b009262ec2c7e84839af9729b752f14e SHA1: 8d96f40da8970ddd48af4517512a0fdd077c33da SHA256: daed7ea5b66bce3821742564af812b6f4e25939b3d273ed5a156ba7c92c452dc File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/jquery-ui.jsMD5: 2e5cf7e1e4b6ad05bfb6aead63f372f9SHA1: 81269986fe3d866d0430312c1dc18a718cc2d728SHA256: f6c8f3c1c946e8a5b8d6e129c833fbd680159b53f2413e218675e0e9a72e6c2eReferenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jquery-ui High Vendor file name jquery-ui-dialog High Product file name jquery-ui High Product file name jquery-ui-dialog High Version file version 1.9.0 High
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/jquery.jsMD5: 0b6ecf17e30037994d3ffee51b525914SHA1: d09d3a99ed25d0f1fbe6856de9e14ffd33557256SHA256: f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729Referenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 1.8.2 High
CVE-2012-6708 suppress
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 1.9.0 CVE-2015-9251 suppress
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* versions up to (excluding) 7.0.0.1 cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.0.4.0 cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* versions up to (excluding) 7.2 cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.1; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* versions from (including) 4.3.0.1; versions up to (including) 4.3.0.4 cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* CVE-2019-11358 suppress
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CWE-1321
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.11.0; versions up to (excluding) 1.11.9 cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.12.0; versions up to (excluding) 1.12.6 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.66 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.5.0; versions up to (excluding) 8.5.15 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (excluding) 8.6.15 cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* versions from (including) 3.0.0; versions up to (including) 3.9.4 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 19.1 cpe:2.3:a:oracle:application_service_level_management:13.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_service_level_management:13.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.0; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:diagnostic_assistant:2.12.36:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.5.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_retail_customer_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_performance_insight:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:knowledge:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (including) 8.6.3 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2.0; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:primavera_gateway:15.2.18:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.7; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_mobile_applications:*:*:*:*:*:*:*:* versions up to (including) 19.8 cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:system_utilities:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:transportation_management:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_mobile_workforce_management:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* CVE-2020-11022 suppress
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.2; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* versions from (including) 18.1; versions up to (including) 20.1 cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* versions up to (excluding) 21.1.2 cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.2.2 cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6.0.0; versions up to (including) 8.1.0.0.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 CVE-2020-11023 suppress
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.0.3; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 20.2 cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.1; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* versions up to (excluding) 2.12.41 cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:* versions up to (including) 20.12 cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/jquery.layout.jsMD5: 37b88eaeb78c3f65ac7dcd9cec082c9bSHA1: 2a079f0531d0f4bf3756d390915c3bab23d59e95SHA256: ed45fca8537824fce831d9420fec6b1d1a52ab312f90f04bb5625d7a9ce999c3Referenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/modernizr.custom.jsMD5: 350aeacb2780a90495094db70b7a6d21SHA1: 0b78efd666ca58b71e87d86e83f4768ce51d6348SHA256: d7ba4db2f617af853ad324e7e1a012c43f14ec7436afad430794bb1fe11f7e99Referenced In Projects/Scopes:
livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
Related Dependencies scala-compiler-2.12.10.jar: modernizr.custom.jsFile Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/modernizr.custom.js MD5: 350aeacb2780a90495094db70b7a6d21 SHA1: 0b78efd666ca58b71e87d86e83f4768ce51d6348 SHA256: d7ba4db2f617af853ad324e7e1a012c43f14ec7436afad430794bb1fe11f7e99 File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/raphael-min.jsMD5: ffd330bd214b7b0a8e14e613765b606eSHA1: bfd83096d2178219ccd3f8fc592ae41cdf4e822eSHA256: bc48ca793c3d326ffb5dc26272f0080516416bb772bf97072f0ee44ef0902d4aReferenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/scheduler.jsMD5: c8935628dd9136fbd393272f5ad4ddcfSHA1: 3bfb402f3c98e5f16614849b2fef101d86dfd36eSHA256: fc3f0dfd8c921b1bc7fe81ccc488cc019bdff330aa0ba82651c857acde10db15Referenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/template.jsMD5: 8cdd5585a8e1309998e3b04dc16df935SHA1: 46d98368fe96e32c3326ae4a4da0bb9009497556SHA256: 7a2863204152529fd0351b45eb6668266c46ad3f65767120fcb9cee32da72d35Referenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.11.12/scala-compiler-2.11.12.jar/scala/tools/nsc/doc/html/resource/lib/tools.tooltip.jsMD5: 03e77aac18ea20591d845ec76dff56deSHA1: a792987be027c6076ba530129452482556515a9aSHA256: 57e3a83e9784ff5d76bead2740133ef115fd29eb76fc9a77f151f4674430048eReferenced In Projects/Scopes:
livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/META-INF/maven/jline/jline/pom.xml
MD5: 42f04f8b43896bbbfd67edf50a8eb8bd
SHA1: 4638d05b44d3a9ffc540a5be96be3d719b0c5227
SHA256: 362c543167310e8ef364e6b50387d43943bf293a34db09fbdb5f25a26cf5f564
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor pom artifactid jline Low Vendor pom developer email gnodet@gmail.com Low Vendor pom developer email jason@planet57.com Low Vendor pom developer email mprudhom@gmail.com Low Vendor pom developer id gnodet Medium Vendor pom developer id jdillon Medium Vendor pom developer id mprudhom Medium Vendor pom developer name Guillaume Nodet Medium Vendor pom developer name Jason Dillon Medium Vendor pom developer name Marc Prud'hommeaux Medium Vendor pom groupid jline Highest Vendor pom name JLine High Product pom artifactid jline Highest Product pom developer email gnodet@gmail.com Low Product pom developer email jason@planet57.com Low Product pom developer email mprudhom@gmail.com Low Product pom developer id gnodet Low Product pom developer id jdillon Low Product pom developer id mprudhom Low Product pom developer name Guillaume Nodet Low Product pom developer name Jason Dillon Low Product pom developer name Marc Prud'hommeaux Low Product pom groupid jline Highest Product pom name JLine High Version pom version 2.14.6 Highest
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/diagrams.jsMD5: 2e1f79e48b0e659ed965afa26a201107SHA1: 4c35b9ae3fcb2fcee566878e808544a9c950925bSHA256: d8a8ed1e20a29d4d9a42c984a0b6d74f8781f6258921c257dc234e1552938a74Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/index.jsMD5: a08355a55bc59b335c9afa16d3682a7fSHA1: d3092a1b9c9c06cad11e016c6c1143b2ad821135SHA256: b4c417591851cc8f98521d1c5f6e012e5d853bc0d6efb0443642a39f8f3dc880Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/jquery.min.jsMD5: 220afd743d9e9643852e31a135a9f3aeSHA1: 88523924351bac0b5d560fe0c5781e2556e7693dSHA256: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089aReferenced In Projects/Scopes:
livy-repl_2.12:provided livy-server Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 3.4.1 High
Related Dependencies jquery-3.4.1.min.jsFile Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/jquery-3.4.1.min.js MD5: 220afd743d9e9643852e31a135a9f3ae SHA1: 88523924351bac0b5d560fe0c5781e2556e7693d SHA256: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a pkg:javascript/jquery@3.4.1.min File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/jquery.mousewheel.min.jsMD5: d5843dbdc71ff8014a5eafd346a262daSHA1: 127e1d971efab9341db8079f10663dc28e8e0a2fSHA256: 8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/jquery.panzoom.min.jsMD5: c342421033e7969c439f653fb93a3157SHA1: 57e8700a39d8f95e5768b40d0690c7e572ac0dbdSHA256: 970bfa8aa52c87a1a77718ecd3529037d89818560d90107529d55488612cbba2Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/jquery.slim.min.jsMD5: d9b11ca4d877c327889805b73bb79eddSHA1: dd15958a3f0f1f3601461f927c4703a56ed59011SHA256: a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4fReferenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 3.4.1 High
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/scheduler.jsMD5: 0a0d28a27d996abff56588994ce544e2SHA1: 80370626df86212b4174ce17095abfd6c11105ecSHA256: b38a639a32cfbbfa65bcd0536482c7b8f01e33460a96c1cad2321abf93626d8cReferenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar/scala/tools/nsc/doc/html/resource/lib/template.jsMD5: d34001437bfe41def06b041f374f4e90SHA1: d932577b638f4bc737245e56a774f87b128efee1SHA256: e64b8e321cb0d45471be40ce0069e223b2a84e7d2bb1758752742752e9473d5dReferenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence
Description:
Standard library for the Scala Programming Language License:
BSD 3-Clause: http://www.scala-lang.org/license.html File Path: /root/.m2/repository/org/scala-lang/scala-library/2.11.12/scala-library-2.11.12.jar
MD5: 57c9d7745f84b5e590fd47cb745cb298
SHA1: bf5534e6fec3d665bd6419c952a929a8bdd4b591
SHA256: 0b3d6fd42958ee98715ba2ec5fe221f4ca1e694d7c981b0ae0cd68e97baf6dce
Referenced In Projects/Scopes: livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-scala-api-parent:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile livy-scala-api_2.11:compile livy-core_2.11:compile livy-repl_2.11:provided livy-examples:compile multi-scala-project-root:compile Evidence Type Source Name Value Confidence Vendor file name scala-library High Vendor jar package name language Highest Vendor jar package name scala Highest Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.6, JavaSE-1.7 Low Vendor Manifest bundle-symbolicname org.scala-lang.scala-library Medium Vendor pom artifactid scala-library Highest Vendor pom artifactid scala-library Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name EPFL LAMP Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang Highest Vendor pom name Scala Library High Vendor pom organization name LAMP/EPFL High Vendor pom organization url http://lamp.epfl.ch/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-library High Product jar package name language Highest Product jar package name scala Highest Product Manifest Bundle-Name Scala Standard Library Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.6, JavaSE-1.7 Low Product Manifest bundle-symbolicname org.scala-lang.scala-library Medium Product pom artifactid scala-library Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name EPFL LAMP Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang Highest Product pom name Scala Library High Product pom organization name LAMP/EPFL Low Product pom organization url http://lamp.epfl.ch/ Low Product pom url http://www.scala-lang.org/ Medium Version file version 2.11.12 High Version pom version 2.11.12 Highest
Related Dependencies scala-reflect-2.11.12.jarFile Path: /root/.m2/repository/org/scala-lang/scala-reflect/2.11.12/scala-reflect-2.11.12.jar MD5: 9df7074f889f4670e01ff1dc631520c9 SHA1: 2bb23c13c527566d9828107ca4108be2a2c06f01 SHA256: 6ba385b450a6311a15c918cf8688b9af9327c6104f0ecbd35933cfcd3095fe04 pkg:maven/org.scala-lang/scala-reflect@2.11.12 Description:
Standard library for the Scala Programming Language License:
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/scala-lang/scala-library/2.12.10/scala-library-2.12.10.jar
MD5: 9fcf8259fb239c6f2b148963cac03af2
SHA1: 3509860bc2e5b3da001ed45aca94ffbe5694dbda
SHA256: 0a57044d10895f8d3dd66ad4286891f607169d948845ac51e17b4c1cf0ab569d
Referenced In Projects/Scopes: livy-scala-api_2.12:compile livy-repl_2.12:provided livy-core_2.12:compile Evidence Type Source Name Value Confidence Vendor file name scala-library High Vendor jar package name language Highest Vendor jar package name scala Highest Vendor Manifest automatic-module-name scala.library Medium Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Vendor Manifest bundle-symbolicname org.scala-lang.scala-library Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid scala-library Highest Vendor pom artifactid scala-library Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang Highest Vendor pom name Scala Library High Vendor pom organization name LAMP/EPFL High Vendor pom organization url https://lamp.epfl.ch/ Medium Vendor pom url https://www.scala-lang.org/ Highest Product file name scala-library High Product jar package name language Highest Product jar package name scala Highest Product Manifest automatic-module-name scala.library Medium Product Manifest Bundle-Name Scala Standard Library Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Product Manifest bundle-symbolicname org.scala-lang.scala-library Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid scala-library Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang Highest Product pom name Scala Library High Product pom organization name LAMP/EPFL Low Product pom organization url https://lamp.epfl.ch/ Low Product pom url https://www.scala-lang.org/ Medium Version file version 2.12.10 High Version pom version 2.12.10 Highest
Related Dependencies scala-compiler-2.12.10.jarFile Path: /root/.m2/repository/org/scala-lang/scala-compiler/2.12.10/scala-compiler-2.12.10.jar MD5: f8972c9a2919830dc47ffd26094c4882 SHA1: 33e91b29dff873755751bfc45e916a16100ec818 SHA256: cedc3b9c39d215a9a3ffc0cc75a1d784b51e9edc7f13051a1b4ad5ae22cfbc0c pkg:maven/org.scala-lang/scala-compiler@2.12.10 scala-reflect-2.12.10.jarFile Path: /root/.m2/repository/org/scala-lang/scala-reflect/2.12.10/scala-reflect-2.12.10.jar MD5: 034e8750598cc34716f98fe53bae4457 SHA1: 14cb7beb516cd8e07716133668c427792122c926 SHA256: 56b609e1bab9144fb51525bfa01ccd72028154fc40a58685a1e9adcbe7835730 pkg:maven/org.scala-lang/scala-reflect@2.12.10 Description:
scala-parser-combinators License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-parser-combinators_2.11/1.0.4/scala-parser-combinators_2.11-1.0.4.jar
MD5: ff946f94319accb11847381d3c436837
SHA1: 7369d653bcfa95d321994660477a4d7e81d7f490
SHA256: 0dfaafce29a9a245b0a9180ec2c1073d2bd8f0330f03a9f1f6a74d1bc83f62d6
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name scala-parser-combinators_2.11-1.0.4 High Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Vendor pom artifactid scala-parser-combinators_2.11 Highest Vendor pom artifactid scala-parser-combinators_2.11 Low Vendor pom developer id epfl Medium Vendor pom developer id Typesafe Medium Vendor pom developer name EPFL Medium Vendor pom developer name Typesafe, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-parser-combinators High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-parser-combinators_2.11-1.0.4 High Product jar package name scala Highest Product Manifest Bundle-Name org.scala-lang.modules.scala-parser-combinators Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Product pom artifactid scala-parser-combinators_2.11 Highest Product pom developer id epfl Low Product pom developer id Typesafe Low Product pom developer name EPFL Low Product pom developer name Typesafe, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-parser-combinators High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.0.4 High Version pom version 1.0.4 Highest
Description:
scala-parser-combinators License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-parser-combinators_2.11/1.0.6/scala-parser-combinators_2.11-1.0.6.jar
MD5: f3682e5aefec386abf633ff062fdd5c8
SHA1: 27b31450b7a5c8cc0b82bf8974ff543309f7deda
SHA256: e8d15ebde0ccad54b5c9c82501afef8f7506a12f9500f2526d9c7e76a6ec3618
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name scala-parser-combinators_2.11-1.0.6 High Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Vendor pom artifactid scala-parser-combinators_2.11 Highest Vendor pom artifactid scala-parser-combinators_2.11 Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-parser-combinators High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-parser-combinators_2.11-1.0.6 High Product jar package name scala Highest Product Manifest Bundle-Name org.scala-lang.modules.scala-parser-combinators Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Product pom artifactid scala-parser-combinators_2.11 Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-parser-combinators High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.0.6 High Version pom version 1.0.6 Highest
Description:
scala-parser-combinators License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-parser-combinators_2.11/1.1.0/scala-parser-combinators_2.11-1.1.0.jar
MD5: fecb6cb9effb41746bd661af6713baa7
SHA1: fbf4d9948b22f37c658c8c7712a621a732798b13
SHA256: 5baaad7be5c6fc8142a31ab003f7ee797e488ee137d48df5d9c3c2b3fb0c5bc6
Referenced In Projects/Scopes: livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-rsc:provided livy-test-lib:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name scala-parser-combinators_2.11-1.1.0 High Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid scala-parser-combinators_2.11 Highest Vendor pom artifactid scala-parser-combinators_2.11 Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-parser-combinators High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-parser-combinators_2.11-1.1.0 High Product jar package name scala Highest Product Manifest Bundle-Name scala-parser-combinators Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid scala-parser-combinators_2.11 Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-parser-combinators High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.1.0 High Version pom version 1.1.0 Highest
Description:
scala-parser-combinators License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-parser-combinators_2.12/1.1.0/scala-parser-combinators_2.12-1.1.0.jar
MD5: 764fbf1a71d8d4f52c537189ec7c019c
SHA1: bbce493f8bf61b56623624ff96ac3865f7f6999a
SHA256: 102f2a13efae9486cb4fc01aa4eb92c0543dbd8403f825041746c689f80556e3
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-repl_2.12:provided Evidence Type Source Name Value Confidence Vendor file name scala-parser-combinators_2.12-1.1.0 High Vendor jar package name scala Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid scala-parser-combinators_2.12 Highest Vendor pom artifactid scala-parser-combinators_2.12 Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-parser-combinators High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-parser-combinators_2.12-1.1.0 High Product jar package name scala Highest Product Manifest Bundle-Name scala-parser-combinators Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-parser-combinators Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid scala-parser-combinators_2.12 Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-parser-combinators High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.1.0 High Version pom version 1.1.0 Highest
Description:
scala-xml License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-xml_2.11/1.0.6/scala-xml_2.11-1.0.6.jar
MD5: 3c314aacb4c9a0850eb110cf02640030
SHA1: 4ebd108453e6455351c0ec50d32509ae1154fdb1
SHA256: a3ec190294a15a26706123f140a087a8c0a5db8980e86755e5b8e8fc33ac8d3d
Referenced In Projects/Scopes: livy-repl_2.11:compile livy-server:compile livy-repl-parent:compile Evidence Type Source Name Value Confidence Vendor file name scala-xml_2.11-1.0.6 High Vendor jar package name scala Highest Vendor jar package name xml Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Vendor pom artifactid scala-xml_2.11 Highest Vendor pom artifactid scala-xml_2.11 Low Vendor pom developer id epfl Medium Vendor pom developer id Typesafe Medium Vendor pom developer name EPFL Medium Vendor pom developer name Typesafe, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-xml High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-xml_2.11-1.0.6 High Product jar package name scala Highest Product jar package name xml Highest Product Manifest Bundle-Name org.scala-lang.modules.scala-xml Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Product pom artifactid scala-xml_2.11 Highest Product pom developer id epfl Low Product pom developer id Typesafe Low Product pom developer name EPFL Low Product pom developer name Typesafe, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-xml High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.0.6 High Version pom version 1.0.6 Highest
Description:
scala-xml License:
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/scala-lang/modules/scala-xml_2.11/1.2.0/scala-xml_2.11-1.2.0.jar
MD5: 6a24761f45627897e9859f18ade065e2
SHA1: 0d53914287e29deeb04c9d6031d63f9fbe0c86da
SHA256: eaddac168ef1e28978af768706490fa4358323a08964c25fa1027c52238e3702
Referenced In Projects/Scopes: livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-rsc:provided livy-test-lib:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name scala-xml_2.11-1.2.0 High Vendor jar package name scala Highest Vendor jar package name xml Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid scala-xml_2.11 Highest Vendor pom artifactid scala-xml_2.11 Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-xml High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-xml_2.11-1.2.0 High Product jar package name scala Highest Product jar package name xml Highest Product Manifest Bundle-Name scala-xml Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom artifactid scala-xml_2.11 Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-xml High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.2.0 High Version pom version 1.2.0 Highest
Description:
scala-xml License:
BSD 3-clause: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/scala-lang/modules/scala-xml_2.12/1.0.6/scala-xml_2.12-1.0.6.jar
MD5: ac867dfb81feb7c874f2cbc953453700
SHA1: e22de3366a698a9f744106fb6dda4335838cf6a7
SHA256: 7cc3b6ceb56e879cb977e8e043f4bfe2e062f78795efd7efa09f85003cb3230a
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:compile Evidence Type Source Name Value Confidence Vendor file name scala-xml_2.12-1.0.6 High Vendor jar package name scala Highest Vendor jar package name xml Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Vendor pom artifactid scala-xml_2.12 Highest Vendor pom artifactid scala-xml_2.12 Low Vendor pom developer id epfl Medium Vendor pom developer id Typesafe Medium Vendor pom developer name EPFL Medium Vendor pom developer name Typesafe, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-xml High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-xml_2.12-1.0.6 High Product jar package name scala Highest Product jar package name xml Highest Product Manifest Bundle-Name org.scala-lang.modules.scala-xml Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Product pom artifactid scala-xml_2.12 Highest Product pom developer id epfl Low Product pom developer id Typesafe Low Product pom developer name EPFL Low Product pom developer name Typesafe, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-xml High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.0.6 High Version pom version 1.0.6 Highest
Description:
scala-xml License:
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/scala-lang/modules/scala-xml_2.12/1.2.0/scala-xml_2.12-1.2.0.jar
MD5: 5daf691f15978092fc8424e1fe5245e4
SHA1: 5d38ac30beb8420dd395c0af447ba412158965e6
SHA256: 1b48dc206f527b7604ef32492ada8e71706c63a65d999e0cabdafdc5793b4d63
Referenced In Project/Scope: livy-scala-api_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name scala-xml_2.12-1.2.0 High Vendor jar package name scala Highest Vendor jar package name xml Highest Vendor Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid scala-xml_2.12 Highest Vendor pom artifactid scala-xml_2.12 Low Vendor pom developer id lamp Medium Vendor pom developer id Lightbend Medium Vendor pom developer name LAMP/EPFL Medium Vendor pom developer name Lightbend, Inc. Medium Vendor pom groupid org.scala-lang.modules Highest Vendor pom name scala-xml High Vendor pom organization name org.scala-lang.modules High Vendor pom organization url http://www.scala-lang.org/ Medium Vendor pom url http://www.scala-lang.org/ Highest Product file name scala-xml_2.12-1.2.0 High Product jar package name scala Highest Product jar package name xml Highest Product Manifest Bundle-Name scala-xml Medium Product Manifest bundle-symbolicname org.scala-lang.modules.scala-xml Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid scala-xml_2.12 Highest Product pom developer id lamp Low Product pom developer id Lightbend Low Product pom developer name LAMP/EPFL Low Product pom developer name Lightbend, Inc. Low Product pom groupid org.scala-lang.modules Highest Product pom name scala-xml High Product pom organization name org.scala-lang.modules Low Product pom organization url http://www.scala-lang.org/ Low Product pom url http://www.scala-lang.org/ Medium Version Manifest Bundle-Version 1.2.0 High Version pom version 1.2.0 Highest
Description:
scalactic License:
the Apache License, ASL Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/scalactic/scalactic_2.11/3.0.8/scalactic_2.11-3.0.8.jar
MD5: 044356dba0192aeea5c13ce1492657e6
SHA1: 519147915d9c205eace6a9c75c2068d74fade61e
SHA256: 88cdac4628c42215d08449db85159ba0a72dea9465e9d6eb4c8b4a784ef7ef23
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name scalactic_2.11-3.0.8 High Vendor jar package name scalactic Highest Vendor Manifest bundle-docurl http://www.scalactic.org/ Low Vendor Manifest bundle-symbolicname org.scalactic Medium Vendor pom artifactid scalactic_2.11 Highest Vendor pom artifactid scalactic_2.11 Low Vendor pom developer email bill@artima.com Low Vendor pom developer email cheeseng@amaseng.com Low Vendor pom developer email george.berger@gmail.com Low Vendor pom developer id bvenners Medium Vendor pom developer id cheeseng Medium Vendor pom developer id gcberger Medium Vendor pom developer name Bill Venners Medium Vendor pom developer name Chua Chee Seng Medium Vendor pom developer name George Berger Medium Vendor pom groupid org.scalactic Highest Vendor pom name scalactic High Vendor pom organization name org.scalactic High Vendor pom url http://www.scalatest.org Highest Product file name scalactic_2.11-3.0.8 High Product jar package name scalactic Highest Product jar package name source Highest Product Manifest bundle-docurl http://www.scalactic.org/ Low Product Manifest Bundle-Name Scalactic Medium Product Manifest bundle-symbolicname org.scalactic Medium Product pom artifactid scalactic_2.11 Highest Product pom developer email bill@artima.com Low Product pom developer email cheeseng@amaseng.com Low Product pom developer email george.berger@gmail.com Low Product pom developer id bvenners Low Product pom developer id cheeseng Low Product pom developer id gcberger Low Product pom developer name Bill Venners Low Product pom developer name Chua Chee Seng Low Product pom developer name George Berger Low Product pom groupid org.scalactic Highest Product pom name scalactic High Product pom organization name org.scalactic Low Product pom url http://www.scalatest.org Medium Version Manifest Bundle-Version 3.0.8 High Version pom version 3.0.8 Highest
Description:
scalatest License:
the Apache License, ASL Version 2.0: http://www.apache.org/licenses/LICENSE-2.0 File Path: /root/.m2/repository/org/scalatest/scalatest_2.11/3.0.8/scalatest_2.11-3.0.8.jar
MD5: b3db0bd9b2f60b754b17da2043237a25
SHA1: c75fddee2d6e792d8ac6edcb575f8f23662869cc
SHA256: 606f4324a7d03522303fb30d9370eafdecc42c648c5a0a0ea85f114e09054940
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name scalatest_2.11-3.0.8 High Vendor jar package name scalatest Highest Vendor Manifest bundle-docurl http://www.scalatest.org/ Low Vendor Manifest bundle-symbolicname org.scalatest Medium Vendor pom artifactid scalatest_2.11 Highest Vendor pom artifactid scalatest_2.11 Low Vendor pom developer email bill@artima.com Low Vendor pom developer email cheeseng@amaseng.com Low Vendor pom developer email george.berger@gmail.com Low Vendor pom developer id bvenners Medium Vendor pom developer id cheeseng Medium Vendor pom developer id gcberger Medium Vendor pom developer name Bill Venners Medium Vendor pom developer name Chua Chee Seng Medium Vendor pom developer name George Berger Medium Vendor pom groupid org.scalatest Highest Vendor pom name scalatest High Vendor pom organization name org.scalatest High Vendor pom url http://www.scalatest.org Highest Product file name scalatest_2.11-3.0.8 High Product jar package name framework Highest Product jar package name scalatest Highest Product Manifest bundle-docurl http://www.scalatest.org/ Low Product Manifest Bundle-Name ScalaTest Medium Product Manifest bundle-symbolicname org.scalatest Medium Product pom artifactid scalatest_2.11 Highest Product pom developer email bill@artima.com Low Product pom developer email cheeseng@amaseng.com Low Product pom developer email george.berger@gmail.com Low Product pom developer id bvenners Low Product pom developer id cheeseng Low Product pom developer id gcberger Low Product pom developer name Bill Venners Low Product pom developer name Chua Chee Seng Low Product pom developer name George Berger Low Product pom groupid org.scalatest Highest Product pom name scalatest High Product pom organization name org.scalatest Low Product pom url http://www.scalatest.org Medium Version Manifest Bundle-Version 3.0.8 High Version pom version 3.0.8 Highest
File Path: /root/.m2/repository/org/scalatest/scalatest_2.11/3.0.8/scalatest_2.11-3.0.8.jar/org/scalatest/d3.v2.min.jsMD5: 3d9462e26cf0d0d54173cac85cb16b6fSHA1: 4ecc882b90979714b1e13e2222b2350028b75215SHA256: 4ab5438363baac545e128763c63a7055f8ad89efa181551598e2544ed423bc11Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
File Path: /root/.m2/repository/org/scalatest/scalatest_2.11/3.0.8/scalatest_2.11-3.0.8.jar/org/scalatest/sorttable.jsMD5: eedc4aca5982d90967b744f8b6d3f65bSHA1: eb14586215b095107ef577f99c3880405f317376SHA256: 5fc1b3d1104c662122cdcfbda9a6d6a51614b3bf14f33483f2090df4bbb1dfa3Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence
Description:
scalatra-common License:
BSD: http://github.com/scalatra/scalatra/raw/HEAD/LICENSE File Path: /root/.m2/repository/org/scalatra/scalatra-common_2.11/2.6.5/scalatra-common_2.11-2.6.5.jar
MD5: 20fe4a9c3643f0a729eb4bcc5d732f69
SHA1: 22883468ca8cf0c462a847fc5dba29b6300ef220
SHA256: dd6613b5a7249675386ee603a12b9d7735a532d189c74ffa34f0bda1a9fd110a
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name scalatra-common_2.11-2.6.5 High Vendor jar package name scalatra Highest Vendor Manifest implementation-url http://www.scalatra.org/ Low Vendor Manifest Implementation-Vendor org.scalatra High Vendor Manifest Implementation-Vendor-Id org.scalatra Medium Vendor Manifest specification-vendor org.scalatra Low Vendor pom artifactid scalatra-common_2.11 Highest Vendor pom artifactid scalatra-common_2.11 Low Vendor pom developer id alandipert Medium Vendor pom developer id ayush Medium Vendor pom developer id BowlingX Medium Vendor pom developer id casualjim Medium Vendor pom developer id ceedubs Medium Vendor pom developer id chirino Medium Vendor pom developer id dozed Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jlarmstrong Medium Vendor pom developer id mnylen Medium Vendor pom developer id riffraff Medium Vendor pom developer id rossabaker Medium Vendor pom developer id sdb Medium Vendor pom developer id seratch Medium Vendor pom developer id ymasory Medium Vendor pom developer name Alan Dipert Medium Vendor pom developer name Ayush Gupta Medium Vendor pom developer name Cody Alen Medium Vendor pom developer name David Heidrich Medium Vendor pom developer name Gabriele Renzi Medium Vendor pom developer name Hiram Chirino Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Jared Armstrong Medium Vendor pom developer name Jean-François Arcand Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom developer name Mikko Nylen Medium Vendor pom developer name Ross A. Baker Medium Vendor pom developer name Stefan De Boey Medium Vendor pom developer name Stefan Ollinger Medium Vendor pom developer name Yuvi Masory Medium Vendor pom groupid org.scalatra Highest Vendor pom name scalatra-common High Vendor pom organization name org.scalatra High Vendor pom organization url http://www.scalatra.org/ Medium Vendor pom url http://www.scalatra.org/ Highest Product file name scalatra-common_2.11-2.6.5 High Product jar package name scalatra Highest Product Manifest Implementation-Title scalatra-common High Product Manifest implementation-url http://www.scalatra.org/ Low Product Manifest specification-title scalatra-common Medium Product pom artifactid scalatra-common_2.11 Highest Product pom developer id alandipert Low Product pom developer id ayush Low Product pom developer id BowlingX Low Product pom developer id casualjim Low Product pom developer id ceedubs Low Product pom developer id chirino Low Product pom developer id dozed Low Product pom developer id jfarcand Low Product pom developer id jlarmstrong Low Product pom developer id mnylen Low Product pom developer id riffraff Low Product pom developer id rossabaker Low Product pom developer id sdb Low Product pom developer id seratch Low Product pom developer id ymasory Low Product pom developer name Alan Dipert Low Product pom developer name Ayush Gupta Low Product pom developer name Cody Alen Low Product pom developer name David Heidrich Low Product pom developer name Gabriele Renzi Low Product pom developer name Hiram Chirino Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Jared Armstrong Low Product pom developer name Jean-François Arcand Low Product pom developer name Kazuhiro Sera Low Product pom developer name Mikko Nylen Low Product pom developer name Ross A. Baker Low Product pom developer name Stefan De Boey Low Product pom developer name Stefan Ollinger Low Product pom developer name Yuvi Masory Low Product pom groupid org.scalatra Highest Product pom name scalatra-common High Product pom organization name org.scalatra Low Product pom organization url http://www.scalatra.org/ Low Product pom url http://www.scalatra.org/ Medium Version Manifest Implementation-Version 2.6.5 High Version pom version 2.6.5 Highest
Description:
JSON support for Scalatra License:
BSD: http://github.com/scalatra/scalatra/raw/HEAD/LICENSE File Path: /root/.m2/repository/org/scalatra/scalatra-json_2.11/2.6.5/scalatra-json_2.11-2.6.5.jar
MD5: 29eb5d2d42fba7c027d5a075a2ea4858
SHA1: 36c9e400c76a68446935431b6c0705b03fd3ebe6
SHA256: f6ae969877a437347eaa439e167de3fc349936028cdca5442cb3b00443081f84
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name scalatra-json_2.11-2.6.5 High Vendor jar package name json Highest Vendor jar package name scalatra Highest Vendor Manifest implementation-url http://www.scalatra.org/ Low Vendor Manifest Implementation-Vendor org.scalatra High Vendor Manifest Implementation-Vendor-Id org.scalatra Medium Vendor Manifest specification-vendor org.scalatra Low Vendor pom artifactid scalatra-json_2.11 Highest Vendor pom artifactid scalatra-json_2.11 Low Vendor pom developer id alandipert Medium Vendor pom developer id ayush Medium Vendor pom developer id BowlingX Medium Vendor pom developer id casualjim Medium Vendor pom developer id ceedubs Medium Vendor pom developer id chirino Medium Vendor pom developer id dozed Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jlarmstrong Medium Vendor pom developer id mnylen Medium Vendor pom developer id riffraff Medium Vendor pom developer id rossabaker Medium Vendor pom developer id sdb Medium Vendor pom developer id seratch Medium Vendor pom developer id ymasory Medium Vendor pom developer name Alan Dipert Medium Vendor pom developer name Ayush Gupta Medium Vendor pom developer name Cody Alen Medium Vendor pom developer name David Heidrich Medium Vendor pom developer name Gabriele Renzi Medium Vendor pom developer name Hiram Chirino Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Jared Armstrong Medium Vendor pom developer name Jean-François Arcand Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom developer name Mikko Nylen Medium Vendor pom developer name Ross A. Baker Medium Vendor pom developer name Stefan De Boey Medium Vendor pom developer name Stefan Ollinger Medium Vendor pom developer name Yuvi Masory Medium Vendor pom groupid org.scalatra Highest Vendor pom name scalatra-json High Vendor pom organization name org.scalatra High Vendor pom organization url http://www.scalatra.org/ Medium Vendor pom url http://www.scalatra.org/ Highest Product file name scalatra-json_2.11-2.6.5 High Product jar package name json Highest Product jar package name scalatra Highest Product Manifest Implementation-Title scalatra-json High Product Manifest implementation-url http://www.scalatra.org/ Low Product Manifest specification-title scalatra-json Medium Product pom artifactid scalatra-json_2.11 Highest Product pom developer id alandipert Low Product pom developer id ayush Low Product pom developer id BowlingX Low Product pom developer id casualjim Low Product pom developer id ceedubs Low Product pom developer id chirino Low Product pom developer id dozed Low Product pom developer id jfarcand Low Product pom developer id jlarmstrong Low Product pom developer id mnylen Low Product pom developer id riffraff Low Product pom developer id rossabaker Low Product pom developer id sdb Low Product pom developer id seratch Low Product pom developer id ymasory Low Product pom developer name Alan Dipert Low Product pom developer name Ayush Gupta Low Product pom developer name Cody Alen Low Product pom developer name David Heidrich Low Product pom developer name Gabriele Renzi Low Product pom developer name Hiram Chirino Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Jared Armstrong Low Product pom developer name Jean-François Arcand Low Product pom developer name Kazuhiro Sera Low Product pom developer name Mikko Nylen Low Product pom developer name Ross A. Baker Low Product pom developer name Stefan De Boey Low Product pom developer name Stefan Ollinger Low Product pom developer name Yuvi Masory Low Product pom groupid org.scalatra Highest Product pom name scalatra-json High Product pom organization name org.scalatra Low Product pom organization url http://www.scalatra.org/ Low Product pom url http://www.scalatra.org/ Medium Version Manifest Implementation-Version 2.6.5 High Version pom version 2.6.5 Highest
Description:
Scalatra integration with Metrics License:
BSD: http://github.com/scalatra/scalatra/raw/HEAD/LICENSE File Path: /root/.m2/repository/org/scalatra/scalatra-metrics_2.11/2.6.5/scalatra-metrics_2.11-2.6.5.jar
MD5: 78475aa6e9bacc3dff2bbf83025e751c
SHA1: 6861d435bd53835d1a11ccb2dc403d9aa7dad19b
SHA256: 7bf0d118531f51531a1dfa20d6169a5aa156985adde116ad88db24079f16f672
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name scalatra-metrics_2.11-2.6.5 High Vendor jar package name metrics Highest Vendor jar package name scalatra Highest Vendor Manifest implementation-url http://www.scalatra.org/ Low Vendor Manifest Implementation-Vendor org.scalatra High Vendor Manifest Implementation-Vendor-Id org.scalatra Medium Vendor Manifest specification-vendor org.scalatra Low Vendor pom artifactid scalatra-metrics_2.11 Highest Vendor pom artifactid scalatra-metrics_2.11 Low Vendor pom developer id alandipert Medium Vendor pom developer id ayush Medium Vendor pom developer id BowlingX Medium Vendor pom developer id casualjim Medium Vendor pom developer id ceedubs Medium Vendor pom developer id chirino Medium Vendor pom developer id dozed Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jlarmstrong Medium Vendor pom developer id mnylen Medium Vendor pom developer id riffraff Medium Vendor pom developer id rossabaker Medium Vendor pom developer id sdb Medium Vendor pom developer id seratch Medium Vendor pom developer id ymasory Medium Vendor pom developer name Alan Dipert Medium Vendor pom developer name Ayush Gupta Medium Vendor pom developer name Cody Alen Medium Vendor pom developer name David Heidrich Medium Vendor pom developer name Gabriele Renzi Medium Vendor pom developer name Hiram Chirino Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Jared Armstrong Medium Vendor pom developer name Jean-François Arcand Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom developer name Mikko Nylen Medium Vendor pom developer name Ross A. Baker Medium Vendor pom developer name Stefan De Boey Medium Vendor pom developer name Stefan Ollinger Medium Vendor pom developer name Yuvi Masory Medium Vendor pom groupid org.scalatra Highest Vendor pom name scalatra-metrics High Vendor pom organization name org.scalatra High Vendor pom organization url http://www.scalatra.org/ Medium Vendor pom url http://www.scalatra.org/ Highest Product file name scalatra-metrics_2.11-2.6.5 High Product jar package name metrics Highest Product jar package name scalatra Highest Product Manifest Implementation-Title scalatra-metrics High Product Manifest implementation-url http://www.scalatra.org/ Low Product Manifest specification-title scalatra-metrics Medium Product pom artifactid scalatra-metrics_2.11 Highest Product pom developer id alandipert Low Product pom developer id ayush Low Product pom developer id BowlingX Low Product pom developer id casualjim Low Product pom developer id ceedubs Low Product pom developer id chirino Low Product pom developer id dozed Low Product pom developer id jfarcand Low Product pom developer id jlarmstrong Low Product pom developer id mnylen Low Product pom developer id riffraff Low Product pom developer id rossabaker Low Product pom developer id sdb Low Product pom developer id seratch Low Product pom developer id ymasory Low Product pom developer name Alan Dipert Low Product pom developer name Ayush Gupta Low Product pom developer name Cody Alen Low Product pom developer name David Heidrich Low Product pom developer name Gabriele Renzi Low Product pom developer name Hiram Chirino Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Jared Armstrong Low Product pom developer name Jean-François Arcand Low Product pom developer name Kazuhiro Sera Low Product pom developer name Mikko Nylen Low Product pom developer name Ross A. Baker Low Product pom developer name Stefan De Boey Low Product pom developer name Stefan Ollinger Low Product pom developer name Yuvi Masory Low Product pom groupid org.scalatra Highest Product pom name scalatra-metrics High Product pom organization name org.scalatra Low Product pom organization url http://www.scalatra.org/ Low Product pom url http://www.scalatra.org/ Medium Version Manifest Implementation-Version 2.6.5 High Version pom version 2.6.5 Highest
Description:
The abstract Scalatra test framework License:
BSD: http://github.com/scalatra/scalatra/raw/HEAD/LICENSE File Path: /root/.m2/repository/org/scalatra/scalatra-test_2.11/2.6.5/scalatra-test_2.11-2.6.5.jar
MD5: 2c994ac12aadda02ce201417dd478704
SHA1: a19b5c6f00397ad95e91282d1de2911377c75bfd
SHA256: 1ba76f87dac38f2b8fc17304af5080254b8087e8b636c71feff36ac540437304
Referenced In Project/Scope: livy-integration-test:compile
Evidence Type Source Name Value Confidence Vendor file name scalatra-test_2.11-2.6.5 High Vendor jar package name scalatra Highest Vendor jar package name test Highest Vendor Manifest implementation-url http://www.scalatra.org/ Low Vendor Manifest Implementation-Vendor org.scalatra High Vendor Manifest Implementation-Vendor-Id org.scalatra Medium Vendor Manifest specification-vendor org.scalatra Low Vendor pom artifactid scalatra-test_2.11 Highest Vendor pom artifactid scalatra-test_2.11 Low Vendor pom developer id alandipert Medium Vendor pom developer id ayush Medium Vendor pom developer id BowlingX Medium Vendor pom developer id casualjim Medium Vendor pom developer id ceedubs Medium Vendor pom developer id chirino Medium Vendor pom developer id dozed Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jlarmstrong Medium Vendor pom developer id mnylen Medium Vendor pom developer id riffraff Medium Vendor pom developer id rossabaker Medium Vendor pom developer id sdb Medium Vendor pom developer id seratch Medium Vendor pom developer id ymasory Medium Vendor pom developer name Alan Dipert Medium Vendor pom developer name Ayush Gupta Medium Vendor pom developer name Cody Alen Medium Vendor pom developer name David Heidrich Medium Vendor pom developer name Gabriele Renzi Medium Vendor pom developer name Hiram Chirino Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Jared Armstrong Medium Vendor pom developer name Jean-François Arcand Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom developer name Mikko Nylen Medium Vendor pom developer name Ross A. Baker Medium Vendor pom developer name Stefan De Boey Medium Vendor pom developer name Stefan Ollinger Medium Vendor pom developer name Yuvi Masory Medium Vendor pom groupid org.scalatra Highest Vendor pom name scalatra-test High Vendor pom organization name org.scalatra High Vendor pom organization url http://www.scalatra.org/ Medium Vendor pom url http://www.scalatra.org/ Highest Product file name scalatra-test_2.11-2.6.5 High Product jar package name scalatra Highest Product jar package name test Highest Product Manifest Implementation-Title scalatra-test High Product Manifest implementation-url http://www.scalatra.org/ Low Product Manifest specification-title scalatra-test Medium Product pom artifactid scalatra-test_2.11 Highest Product pom developer id alandipert Low Product pom developer id ayush Low Product pom developer id BowlingX Low Product pom developer id casualjim Low Product pom developer id ceedubs Low Product pom developer id chirino Low Product pom developer id dozed Low Product pom developer id jfarcand Low Product pom developer id jlarmstrong Low Product pom developer id mnylen Low Product pom developer id riffraff Low Product pom developer id rossabaker Low Product pom developer id sdb Low Product pom developer id seratch Low Product pom developer id ymasory Low Product pom developer name Alan Dipert Low Product pom developer name Ayush Gupta Low Product pom developer name Cody Alen Low Product pom developer name David Heidrich Low Product pom developer name Gabriele Renzi Low Product pom developer name Hiram Chirino Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Jared Armstrong Low Product pom developer name Jean-François Arcand Low Product pom developer name Kazuhiro Sera Low Product pom developer name Mikko Nylen Low Product pom developer name Ross A. Baker Low Product pom developer name Stefan De Boey Low Product pom developer name Stefan Ollinger Low Product pom developer name Yuvi Masory Low Product pom groupid org.scalatra Highest Product pom name scalatra-test High Product pom organization name org.scalatra Low Product pom organization url http://www.scalatra.org/ Low Product pom url http://www.scalatra.org/ Medium Version Manifest Implementation-Version 2.6.5 High Version pom version 2.6.5 Highest
Description:
The core Scalatra framework License:
BSD: http://github.com/scalatra/scalatra/raw/HEAD/LICENSE File Path: /root/.m2/repository/org/scalatra/scalatra_2.11/2.6.5/scalatra_2.11-2.6.5.jar
MD5: 539d7f5d10e953be3a7b1c1aabe62b43
SHA1: 6ca1ffe7a04da1ca8deb49d8d9b3019b8c237b29
SHA256: 90a6529ff67e41b662f0c5add54b54ead12e2cc496c84e825974da9ebdaf902f
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name scalatra_2.11-2.6.5 High Vendor jar package name scalatra Highest Vendor Manifest implementation-url http://www.scalatra.org/ Low Vendor Manifest Implementation-Vendor org.scalatra High Vendor Manifest Implementation-Vendor-Id org.scalatra Medium Vendor Manifest specification-vendor org.scalatra Low Vendor pom artifactid scalatra_2.11 Highest Vendor pom artifactid scalatra_2.11 Low Vendor pom developer id alandipert Medium Vendor pom developer id ayush Medium Vendor pom developer id BowlingX Medium Vendor pom developer id casualjim Medium Vendor pom developer id ceedubs Medium Vendor pom developer id chirino Medium Vendor pom developer id dozed Medium Vendor pom developer id jfarcand Medium Vendor pom developer id jlarmstrong Medium Vendor pom developer id mnylen Medium Vendor pom developer id riffraff Medium Vendor pom developer id rossabaker Medium Vendor pom developer id sdb Medium Vendor pom developer id seratch Medium Vendor pom developer id ymasory Medium Vendor pom developer name Alan Dipert Medium Vendor pom developer name Ayush Gupta Medium Vendor pom developer name Cody Alen Medium Vendor pom developer name David Heidrich Medium Vendor pom developer name Gabriele Renzi Medium Vendor pom developer name Hiram Chirino Medium Vendor pom developer name Ivan Porto Carrero Medium Vendor pom developer name Jared Armstrong Medium Vendor pom developer name Jean-François Arcand Medium Vendor pom developer name Kazuhiro Sera Medium Vendor pom developer name Mikko Nylen Medium Vendor pom developer name Ross A. Baker Medium Vendor pom developer name Stefan De Boey Medium Vendor pom developer name Stefan Ollinger Medium Vendor pom developer name Yuvi Masory Medium Vendor pom groupid org.scalatra Highest Vendor pom name scalatra High Vendor pom organization name org.scalatra High Vendor pom organization url http://www.scalatra.org/ Medium Vendor pom url http://www.scalatra.org/ Highest Product file name scalatra_2.11-2.6.5 High Product jar package name http Highest Product jar package name scalatra Highest Product Manifest Implementation-Title scalatra High Product Manifest implementation-url http://www.scalatra.org/ Low Product Manifest specification-title scalatra Medium Product pom artifactid scalatra_2.11 Highest Product pom developer id alandipert Low Product pom developer id ayush Low Product pom developer id BowlingX Low Product pom developer id casualjim Low Product pom developer id ceedubs Low Product pom developer id chirino Low Product pom developer id dozed Low Product pom developer id jfarcand Low Product pom developer id jlarmstrong Low Product pom developer id mnylen Low Product pom developer id riffraff Low Product pom developer id rossabaker Low Product pom developer id sdb Low Product pom developer id seratch Low Product pom developer id ymasory Low Product pom developer name Alan Dipert Low Product pom developer name Ayush Gupta Low Product pom developer name Cody Alen Low Product pom developer name David Heidrich Low Product pom developer name Gabriele Renzi Low Product pom developer name Hiram Chirino Low Product pom developer name Ivan Porto Carrero Low Product pom developer name Jared Armstrong Low Product pom developer name Jean-François Arcand Low Product pom developer name Kazuhiro Sera Low Product pom developer name Mikko Nylen Low Product pom developer name Ross A. Baker Low Product pom developer name Stefan De Boey Low Product pom developer name Stefan Ollinger Low Product pom developer name Yuvi Masory Low Product pom groupid org.scalatra Highest Product pom name scalatra High Product pom organization name org.scalatra Low Product pom organization url http://www.scalatra.org/ Low Product pom url http://www.scalatra.org/ Medium Version Manifest Implementation-Version 2.6.5 High Version pom version 2.6.5 Highest
File Path: /root/.m2/repository/javax/servlet/servlet-api/2.5/servlet-api-2.5.jarMD5: 69ca51af4e9a67a1027a7f95b52c3e8fSHA1: 5959582d97d8b61f4d154ca9e495aafd16726e34SHA256: c658ea360a70faeeadb66fb3c90a702e4142a0ab7768f9ae9828678e0d9ad4dcReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile Evidence Type Source Name Value Confidence Vendor file name servlet-api High Vendor jar package name javax Highest Vendor jar package name servlet Highest Vendor Manifest extension-name servlet-api Medium Vendor Manifest Implementation-Vendor Sun Microsystems Inc High Vendor Manifest specification-vendor Sun Microsystems Inc Low Vendor pom artifactid servlet-api Highest Vendor pom artifactid servlet-api Low Vendor pom groupid javax.servlet Highest Product file name servlet-api High Product jar package name javax Highest Product jar package name servlet Highest Product Manifest extension-name servlet-api Medium Product Manifest Implementation-Title High Product Manifest specification-title A component of the Glassfish Application Server Medium Product pom artifactid servlet-api Highest Product pom groupid javax.servlet Highest Version file version 2.5 High Version Manifest Implementation-Version 2.5 High Version pom version 2.5 Highest
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/session-log.jsMD5: d704ff0ccceb642c627e06ea6f2adec4SHA1: bb83c229530e49ea7ac43d12752d1550331b7f43SHA256: 859378d7665f63d0812cd92656979e39771ed298ebf6036fdad39b35f1bda211Referenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
File Path: /workspace/server/src/main/resources/org/apache/livy/server/ui/static/js/session.jsMD5: 786599b0ac61084d3b1dca8ca8b56ca3SHA1: cec3f31396236c38c2b3f86a47d4531611bc922dSHA256: c9b198bfb44cc5161caa4341609c3afc76208e0ad40bf1445d016dfb60a4afc2Referenced In Project/Scope: livy-server
Evidence Type Source Name Value Confidence
Description:
core License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/chuusai/shapeless_2.11/2.3.2/shapeless_2.11-2.3.2.jar
MD5: c3c1d18f6978a2b10983c75499d36930
SHA1: f40ed6e303d550293f5f8f3743681d98e31f2360
SHA256: f9741699b9a84d218c97907f445ea24f401f84239041c91332ca53c481670e36
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name shapeless_2.11-2.3.2 High Vendor jar package name shapeless Highest Vendor Manifest bundle-symbolicname shapeless Medium Vendor pom artifactid shapeless_2.11 Highest Vendor pom artifactid shapeless_2.11 Low Vendor pom developer id milessabin Medium Vendor pom developer name Miles Sabin Medium Vendor pom groupid com.chuusai Highest Vendor pom name core High Vendor pom organization name com.chuusai High Vendor pom organization url milessabin/shapeless Medium Vendor pom url milessabin/shapeless Highest Product file name shapeless_2.11-2.3.2 High Product jar package name shapeless Highest Product Manifest Bundle-Name shapeless Medium Product Manifest bundle-symbolicname shapeless Medium Product pom artifactid shapeless_2.11 Highest Product pom developer id milessabin Low Product pom developer name Miles Sabin Low Product pom groupid com.chuusai Highest Product pom name core High Product pom organization name com.chuusai Low Product pom url milessabin/shapeless High Version Manifest Bundle-Version 2.3.2 High Version pom version 2.3.2 Highest
Description:
core License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/chuusai/shapeless_2.12/2.3.2/shapeless_2.12-2.3.2.jar
MD5: 17a0b8115c75da11076791ac4fe950f7
SHA1: 27e115ffed7917b456e54891de67173f4a68d5f1
SHA256: 75926d9dd4688710ca16d852b58746dcfc013a2a1a58d1e817a27f95b2d42303
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name shapeless_2.12-2.3.2 High Vendor jar package name shapeless Highest Vendor Manifest bundle-symbolicname shapeless Medium Vendor pom artifactid shapeless_2.12 Highest Vendor pom artifactid shapeless_2.12 Low Vendor pom developer id milessabin Medium Vendor pom developer name Miles Sabin Medium Vendor pom groupid com.chuusai Highest Vendor pom name core High Vendor pom organization name com.chuusai High Vendor pom organization url milessabin/shapeless Medium Vendor pom url milessabin/shapeless Highest Product file name shapeless_2.12-2.3.2 High Product jar package name shapeless Highest Product Manifest Bundle-Name shapeless Medium Product Manifest bundle-symbolicname shapeless Medium Product pom artifactid shapeless_2.12 Highest Product pom developer id milessabin Low Product pom developer name Miles Sabin Low Product pom groupid com.chuusai Highest Product pom name core High Product pom organization name com.chuusai Low Product pom url milessabin/shapeless High Version Manifest Bundle-Version 2.3.2 High Version pom version 2.3.2 Highest
File Path: /root/.m2/repository/org/roaringbitmap/shims/0.7.45/shims-0.7.45.jarMD5: 3b98287c4745f90a9dda7aa77e4405f1SHA1: efcebd3284aaba8bc0c72040018a72e8ba7530bcSHA256: 8eab000cdb5d24a51007a853734f361469327ed7bade44ba8180fd3e4fb0fd5dReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name shims High Vendor jar package name org Highest Vendor jar package name roaringbitmap Highest Vendor Manifest multi-release true Low Vendor pom artifactid shims Highest Vendor pom artifactid shims Low Vendor pom groupid org.roaringbitmap Highest Vendor pom parent-artifactid RoaringBitmapParent Low Product file name shims High Product jar package name org Highest Product jar package name roaringbitmap Highest Product Manifest multi-release true Low Product pom artifactid shims Highest Product pom groupid org.roaringbitmap Highest Product pom parent-artifactid RoaringBitmapParent Medium Version file version 0.7.45 High Version pom version 0.7.45 Highest
Description:
The slf4j API File Path: /root/.m2/repository/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jarMD5: caafe376afb7086dcbee79f780394ca3SHA1: da76ca59f6a57ee3102f8f9bd9cee742973efa8aSHA256: 18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-core-parent:compile livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-core_2.11:compile livy-client-common:provided livy-core_2.12:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name slf4j-api High Vendor jar package name slf4j Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname slf4j.api Medium Vendor pom artifactid slf4j-api Highest Vendor pom artifactid slf4j-api Low Vendor pom groupid org.slf4j Highest Vendor pom name SLF4J API Module High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name slf4j-api High Product jar package name slf4j Highest Product Manifest Bundle-Name slf4j-api Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname slf4j.api Medium Product Manifest Implementation-Title slf4j-api High Product pom artifactid slf4j-api Highest Product pom groupid org.slf4j Highest Product pom name SLF4J API Module High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.25 High Version Manifest Bundle-Version 1.7.25 High Version Manifest Implementation-Version 1.7.25 High Version pom version 1.7.25 Highest
Description:
SLF4J LOG4J-12 Binding File Path: /root/.m2/repository/org/slf4j/slf4j-log4j12/1.7.10/slf4j-log4j12-1.7.10.jarMD5: 77c1e048b5110a007dd5b8e808d76b1fSHA1: b3eeae7d1765f988a1f45ea81517191315c69c9eSHA256: 2e4eebc6e346c92c417aa4e662738802645ef21c5eb4435132dc78d631f2eebbReferenced In Projects/Scopes:
livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile livy-server:compile Evidence Type Source Name Value Confidence Vendor file name slf4j-log4j12 High Vendor jar package name slf4j Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.3 Low Vendor Manifest bundle-symbolicname slf4j.log4j12 Medium Vendor pom artifactid slf4j-log4j12 Highest Vendor pom artifactid slf4j-log4j12 Low Vendor pom groupid org.slf4j Highest Vendor pom name SLF4J LOG4J-12 Binding High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name slf4j-log4j12 High Product jar package name slf4j Highest Product Manifest Bundle-Name slf4j-log4j12 Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.3 Low Product Manifest bundle-symbolicname slf4j.log4j12 Medium Product Manifest Implementation-Title slf4j-log4j12 High Product pom artifactid slf4j-log4j12 Highest Product pom groupid org.slf4j Highest Product pom name SLF4J LOG4J-12 Binding High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.10 High Version Manifest Bundle-Version 1.7.10 High Version Manifest Implementation-Version 1.7.10 High Version pom version 1.7.10 Highest
Description:
SLF4J LOG4J-12 Binding File Path: /root/.m2/repository/org/slf4j/slf4j-log4j12/1.7.16/slf4j-log4j12-1.7.16.jarMD5: 3a8f282432cbe7b0bad2c0183e6f52e9SHA1: 54c6dd23a7c420e40b8848e962d5f2a3534260afSHA256: 9dd065184eaaa0e92bb9d4b82d036456cbbb0e09b8c7eaed6ac59b8cfe9fe429Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name slf4j-log4j12 High Vendor jar package name slf4j Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname slf4j.log4j12 Medium Vendor pom artifactid slf4j-log4j12 Highest Vendor pom artifactid slf4j-log4j12 Low Vendor pom groupid org.slf4j Highest Vendor pom name SLF4J LOG4J-12 Binding High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name slf4j-log4j12 High Product jar package name slf4j Highest Product Manifest Bundle-Name slf4j-log4j12 Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname slf4j.log4j12 Medium Product Manifest Implementation-Title slf4j-log4j12 High Product pom artifactid slf4j-log4j12 Highest Product pom groupid org.slf4j Highest Product pom name SLF4J LOG4J-12 Binding High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.16 High Version Manifest Bundle-Version 1.7.16 High Version Manifest Implementation-Version 1.7.16 High Version pom version 1.7.16 Highest
Description:
Port of Snappy to Java License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /root/.m2/repository/org/iq80/snappy/snappy/0.2/snappy-0.2.jar
MD5: a5407f2fac7109aa0734a2d9daec87ba
SHA1: c41f070352713ea90cda7712f493f933fcb066e8
SHA256: 58e906a75f1a5a73d6b527f5acfd15a01f14408fecefe5be6ed88f217647f36a
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name snappy High Vendor jar package name iq80 Highest Vendor jar package name iq80 Low Vendor jar package name snappy Highest Vendor jar package name snappy Low Vendor pom artifactid snappy Highest Vendor pom artifactid snappy Low Vendor pom developer email dain@iq80.com Low Vendor pom developer email david@acz.org Low Vendor pom developer id dain Medium Vendor pom developer id electrum Medium Vendor pom developer name Dain Sundstrom Medium Vendor pom developer name David Phillips Medium Vendor pom groupid org.iq80.snappy Highest Vendor pom name snappy High Vendor pom url http://github.com/dain/snappy Highest Product file name snappy High Product jar package name iq80 Highest Product jar package name snappy Highest Product jar package name snappy Low Product pom artifactid snappy Highest Product pom developer email dain@iq80.com Low Product pom developer email david@acz.org Low Product pom developer id dain Low Product pom developer id electrum Low Product pom developer name Dain Sundstrom Low Product pom developer name David Phillips Low Product pom groupid org.iq80.snappy Highest Product pom name snappy High Product pom url http://github.com/dain/snappy Medium Version file version 0.2 High Version pom version 0.2 Highest
Description:
snappy-java: A fast compression/decompression library License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.0.4.1/snappy-java-1.0.4.1.jar
MD5: 3fad0dcafbced1e3475e3ad7bdd3236b
SHA1: f88b89a5a21a466aeb0ecf0c063605bd584b4947
SHA256: 52533e94f79beacb9862bac33fa2e2fc724a8cfb2a739c33ae4ea10515f2bb86
Referenced In Projects/Scopes: livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name snappy-java High Vendor jar package name snappy Highest Vendor jar package name xerial Highest Vendor Manifest bundle-docurl http://www.xerial.org/ Low Vendor Manifest bundle-symbolicname org.xerial.snappy.snappy-java Medium Vendor pom artifactid snappy-java Highest Vendor pom artifactid snappy-java Low Vendor pom developer email leo@xerial.org Low Vendor pom developer id leo Medium Vendor pom developer name Taro L. Saito Medium Vendor pom developer org Xerial Project Medium Vendor pom groupid org.xerial.snappy Highest Vendor pom name Snappy for Java High Vendor pom organization name xerial.org High Vendor pom organization url http://www.xerial.org/ Medium Vendor pom url http://code.google.com/p/snappy-java/ Highest Product file name snappy-java High Product jar package name snappy Highest Product jar package name xerial Highest Product Manifest bundle-docurl http://www.xerial.org/ Low Product Manifest Bundle-Name org.xerial.snappy.snappy-java Medium Product Manifest bundle-symbolicname org.xerial.snappy.snappy-java Medium Product pom artifactid snappy-java Highest Product pom developer email leo@xerial.org Low Product pom developer id leo Low Product pom developer name Taro L. Saito Low Product pom developer org Xerial Project Low Product pom groupid org.xerial.snappy Highest Product pom name Snappy for Java High Product pom organization name xerial.org Low Product pom organization url http://www.xerial.org/ Low Product pom url http://code.google.com/p/snappy-java/ Medium Version file version 1.0.4.1 High Version Manifest Bundle-Version 1.0.4.1 High Version pom version 1.0.4.1 Highest
File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.0.4.1/snappy-java-1.0.4.1.jar/org/xerial/snappy/native/Windows/amd64/snappyjava.dllMD5: 09989290a9d23aa887ad3919c8daf6bdSHA1: 1ca8cb25c14aa3574e1c2d362e11b97b889dc466SHA256: f0bcc10fb910803d2ce1dfc36fe792066a27570ecacdeedf9d98e7b758f37b44Referenced In Projects/Scopes:
livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name snappyjava High Product file name snappyjava High
File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.0.4.1/snappy-java-1.0.4.1.jar/org/xerial/snappy/native/Windows/x86/snappyjava.dllMD5: 02d0731854ac1be878dc4d6e2555aa2dSHA1: baf474b2ad0b6873e2d99764ea61dcb42f850e24SHA256: e063f8c7329c9e95f61fac2d2c91330440cd45ff832582a46080c082fa8a0c56Referenced In Projects/Scopes:
livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name snappyjava High Product file name snappyjava High
Description:
snappy-java: A fast compression/decompression library License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.1.7.3/snappy-java-1.1.7.3.jar
MD5: 069c880d31204a1a0fc28a4054f5372a
SHA1: 241bb74a1eb37d68a4e324a4bc3865427de0a62d
SHA256: 7eea31c0a25d35cd092d8aec08bed04f22152409b58d63d43839074a9ab7ab97
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name snappy-java High Vendor jar package name snappy Highest Vendor jar package name xerial Highest Vendor Manifest bundle-activationpolicy lazy Low Vendor Manifest bundle-docurl http://www.xerial.org/ Low Vendor Manifest bundle-nativecode org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=x86-64,org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=x64,org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=amd64,org/xerial/snappy/native/Windows/x86/snappyjava.dll;osname=win32;processor=x86,org/xerial/snappy/native/Mac/x86/libsnappyjava.jnilib;osname=macosx;processor=x86,org/xerial/snappy/native/Mac/x86_64/libsnappyjava.jnilib;osname=macosx;processor=x86-64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=x86-64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=x64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=amd64,org/xerial/snappy/native/Linux/x86/libsnappyjava.so;osname=linux;processor=x86,org/xerial/snappy/native/Linux/aarch64/libsnappyjava.so;osname=linux;processor=aarch64,org/xerial/snappy/native/Linux/arm/libsnappyjava.so;osname=linux;processor=arm,org/xerial/snappy/native/Linux/armv7/libsnappyjava.so;osname=linux;processor=arm_le,org/xerial/snappy/native/Linux/ppc64/libsnappyjava.so;osname=linux;processor=ppc64le,org/xerial/snappy/native/Linux/s390x/libsnappyjava.so;osname=linux;processor=s390x,org/xerial/snappy/native/AIX/ppc/libsnappyjava.a;osname=aix;processor=ppc,org/xerial/snappy/native/AIX/ppc64/libsnappyjava.a;osname=aix;processor=ppc64,org/xerial/snappy/native/SunOS/x86/libsnappyjava.so;osname=sunos;processor=x86,org/xerial/snappy/native/SunOS/x86_64/libsnappyjava.so;osname=sunos;processor=x86-64,org/xerial/snappy/native/SunOS/sparc/libsnappyjava.so;osname=sunos;processor=sparc Low Vendor Manifest bundle-symbolicname org.xerial.snappy.snappy-java Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom artifactid snappy-java Highest Vendor pom artifactid snappy-java Low Vendor pom developer email leo@xerial.org Low Vendor pom developer id leo Medium Vendor pom developer name Taro L. Saito Medium Vendor pom developer org Xerial Project Medium Vendor pom groupid org.xerial.snappy Highest Vendor pom name snappy-java High Vendor pom organization name xerial.org High Vendor pom url xerial/snappy-java Highest Product file name snappy-java High Product jar package name snappy Highest Product jar package name xerial Highest Product Manifest bundle-activationpolicy lazy Low Product Manifest bundle-docurl http://www.xerial.org/ Low Product Manifest Bundle-Name snappy-java: A fast compression/decompression library Medium Product Manifest bundle-nativecode org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=x86-64,org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=x64,org/xerial/snappy/native/Windows/x86_64/snappyjava.dll;osname=win32;processor=amd64,org/xerial/snappy/native/Windows/x86/snappyjava.dll;osname=win32;processor=x86,org/xerial/snappy/native/Mac/x86/libsnappyjava.jnilib;osname=macosx;processor=x86,org/xerial/snappy/native/Mac/x86_64/libsnappyjava.jnilib;osname=macosx;processor=x86-64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=x86-64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=x64,org/xerial/snappy/native/Linux/x86_64/libsnappyjava.so;osname=linux;processor=amd64,org/xerial/snappy/native/Linux/x86/libsnappyjava.so;osname=linux;processor=x86,org/xerial/snappy/native/Linux/aarch64/libsnappyjava.so;osname=linux;processor=aarch64,org/xerial/snappy/native/Linux/arm/libsnappyjava.so;osname=linux;processor=arm,org/xerial/snappy/native/Linux/armv7/libsnappyjava.so;osname=linux;processor=arm_le,org/xerial/snappy/native/Linux/ppc64/libsnappyjava.so;osname=linux;processor=ppc64le,org/xerial/snappy/native/Linux/s390x/libsnappyjava.so;osname=linux;processor=s390x,org/xerial/snappy/native/AIX/ppc/libsnappyjava.a;osname=aix;processor=ppc,org/xerial/snappy/native/AIX/ppc64/libsnappyjava.a;osname=aix;processor=ppc64,org/xerial/snappy/native/SunOS/x86/libsnappyjava.so;osname=sunos;processor=x86,org/xerial/snappy/native/SunOS/x86_64/libsnappyjava.so;osname=sunos;processor=x86-64,org/xerial/snappy/native/SunOS/sparc/libsnappyjava.so;osname=sunos;processor=sparc Low Product Manifest bundle-symbolicname org.xerial.snappy.snappy-java Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product pom artifactid snappy-java Highest Product pom developer email leo@xerial.org Low Product pom developer id leo Low Product pom developer name Taro L. Saito Low Product pom developer org Xerial Project Low Product pom groupid org.xerial.snappy Highest Product pom name snappy-java High Product pom organization name xerial.org Low Product pom url xerial/snappy-java High Version file version 1.1.7.3 High Version Manifest Bundle-Version 1.1.7.3 High Version pom version 1.1.7.3 Highest
File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.1.7.3/snappy-java-1.1.7.3.jar/org/xerial/snappy/native/Windows/x86/snappyjava.dllMD5: 3311b452e8619f09b279575c5ebac4c7SHA1: b2ab0f778657b4ff3521d7c93e3e5b3b31b96ff9SHA256: 0be631df962e3dc0c5086869e77d00dde089dbde44ebb7a3e7a75b9f61fa2931Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name snappyjava High Product file name snappyjava High
File Path: /root/.m2/repository/org/xerial/snappy/snappy-java/1.1.7.3/snappy-java-1.1.7.3.jar/org/xerial/snappy/native/Windows/x86_64/snappyjava.dllMD5: 82578a05ced2f0dc97c2e6b7d350e4c4SHA1: 79d91441d17e3c81a8bf107ebc9843c642d9e278SHA256: cfc8d0ea172f838b3a7502e378baed72a3ac45020fb9772667e5dffee46d588bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name snappyjava High Product file name snappyjava High
Description:
Jetty Proxy File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/META-INF/maven/org.eclipse.jetty/jetty-proxy/pom.xmlMD5: 06ad2fef832bcdb5436edeedfcec9422SHA1: 1814a288a8955c5c844191bf875459d49c90ad32SHA256: 9855e5f6fac9acafe83b70d3c19b8a9eea89deaa8143823fc57392bc81aa1582Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid jetty-proxy Low Vendor pom groupid org.eclipse.jetty Highest Vendor pom name Jetty :: Proxy High Vendor pom parent-artifactid jetty-project Low Vendor pom url http://www.eclipse.org/jetty Highest Product pom artifactid jetty-proxy Highest Product pom groupid org.eclipse.jetty Highest Product pom name Jetty :: Proxy High Product pom parent-artifactid jetty-project Medium Product pom url http://www.eclipse.org/jetty Medium Version pom version 9.3.27.v20190418 Highest
Related Dependencies spark-core_2.12-2.4.5.jar (shaded: org.eclipse.jetty:jetty-proxy:9.3.27.v20190418)File Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/META-INF/maven/org.eclipse.jetty/jetty-proxy/pom.xml MD5: 06ad2fef832bcdb5436edeedfcec9422 SHA1: 1814a288a8955c5c844191bf875459d49c90ad32 SHA256: 9855e5f6fac9acafe83b70d3c19b8a9eea89deaa8143823fc57392bc81aa1582 pkg:maven/org.eclipse.jetty/jetty-proxy@9.3.27.v20190418 CVE-2022-2047 (OSSINDEX)suppress
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CWE-20 Improper Input Validation
CVSSv2:
Base Score: LOW (2.7) Vector: /AV:N/AC:L/Au:/C:N/I:L/A:N References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.eclipse.jetty:jetty-proxy:9.3.27.v20190418:*:*:*:*:*:*:* Description:
The core jetty server artifact. File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/META-INF/maven/org.eclipse.jetty/jetty-server/pom.xmlMD5: 856e0a0779cce00e85eece4e30a49bcbSHA1: 975397061afe31ee424c4082ef8252c3aeb3c028SHA256: c629cfd6e9b1c5ef749c365c6dd1420359580259a657c2eff507acf18638a194Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid jetty-server Low Vendor pom groupid org.eclipse.jetty Highest Vendor pom name Jetty :: Server Core High Vendor pom parent-artifactid jetty-project Low Vendor pom url http://www.eclipse.org/jetty Highest Product pom artifactid jetty-server Highest Product pom groupid org.eclipse.jetty Highest Product pom name Jetty :: Server Core High Product pom parent-artifactid jetty-project Medium Product pom url http://www.eclipse.org/jetty Medium Version pom version 9.3.27.v20190418 Highest
Related Dependencies CVE-2021-28165 suppress
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. CWE-755 Improper Handling of Exceptional Conditions
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w CONFIRM - https://security.netapp.com/advisory/ntap-20210611-0006/ DEBIAN - DSA-4949 MISC - https://www.oracle.com/security-alerts/cpuapr2022.html MISC - https://www.oracle.com/security-alerts/cpujan2022.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [hbase-commits] 20210408 [hbase-thirdparty] branch master updated: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 (#49) MLIST - [hbase-dev] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Created] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210407 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [GitHub] [hbase-thirdparty] apurtell merged pull request #49: HBASE-25746 [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [hbase-issues] 20210408 [jira] [Updated] (HBASE-25746) [hbase-thirdparty] Update jetty to >= 9.4.39 due to CVE-2021-28165 MLIST - [ignite-dev] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Commented] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty MLIST - [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) Upgrade Jetty version to fix CVE-2021-2816[3,4,5] in Jetty MLIST - [kafka-dev] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-dev] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr opened a new pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Assigned] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Created] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210412 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] chia7712 merged pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] dongjinleekr commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [GitHub] [kafka] edwin092 commented on pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Resolved] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210413 [jira] [Updated] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [kafka-jira] 20210715 [jira] [Commented] (KAFKA-12655) CVE-2021-28165 - Upgrade jetty to 9.4.39 MLIST - [oss-security] 20210420 Vulnerability in Jenkins MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] dinghram opened a new pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210409 [GitHub] [pulsar] merlimat commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai closed pull request #10183: CVE-2021-28165-Jetty MLIST - [pulsar-commits] 20210412 [GitHub] [pulsar] jiazhai commented on pull request #10183: CVE-2021-28165-Jetty MLIST - [solr-issues] 20210414 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210507 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210623 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 MLIST - [solr-issues] 20210813 [jira] [Resolved] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr MLIST - [spark-commits] 20210408 [spark] branch branch-2.4 updated: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-commits] 20210408 [spark] branch branch-3.0 updated: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Assigned] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Commented] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Created] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Resolved] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-issues] 20210408 [jira] [Updated] (SPARK-34988) Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] AmplabJenkins removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] HyukjinKwon commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk closed pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] MaxGekk commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] SparkQA removed a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun closed pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] dongjoon-hyun edited a comment on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak commented on pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32091: [SPARK-34988][CORE] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] sarutak opened a new pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen closed pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32094: [SPARK-34988][CORE][3.0] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] srowen commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210408 [GitHub] [spark] viirya commented on pull request #32093: [SPARK-34988][CORE][2.4] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] dongjoon-hyun commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [spark-reviews] 20210517 [GitHub] [spark] jeffreysmooth commented on pull request #32095: [SPARK-34988][CORE][3.1] Upgrade Jetty for CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.6.3 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-commits] 20210407 [zookeeper] branch master updated: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-dev] 20210407 Re: [VOTE] Apache ZooKeeper release 3.6.3 candidate 1 MLIST - [zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.38 CVE-2021-28165 MLIST - [zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad closed pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] arshadmohammad commented on pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] asfgit closed pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 MLIST - [zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165 N/A - N/A OSSINDEX - [CVE-2021-28165] CWE-755: Improper Handling of Exceptional Conditions OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28165 OSSIndex - https://github.com/eclipse/jetty.project/issues/6072 OSSIndex - https://github.com/eclipse/jetty.project/pull/6074 OSSIndex - https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w Vulnerable Software & Versions: (show all )
CVE-2022-2048 suppress
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2020-27216 suppress
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (4.4) Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-28169 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2021-34428 suppress
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. CWE-613 Insufficient Session Expiration
CVSSv2:
Base Score: LOW (3.6) Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: LOW (3.5) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2022-2047 suppress
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (4.0) Vector: /AV:N/AC:L/Au:S/C:N/I:P/A:N CVSSv3:
Base Score: LOW (2.7) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N References:
Vulnerable Software & Versions: (show all )
File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jarMD5: ad5d86f1bff0981cd9e18ed4a13c0935SHA1: 8f658b9b71ad2ea211fa09296ae88645109ea8d8SHA256: 671aed5ec24f5e57ca0dd596d20d2f44508c549702b5698ec18cb4da444f0d7eReferenced In Projects/Scopes:
livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name spark-core_2.11-2.4.5 High Vendor jar package name apache Highest Vendor jar package name spark Highest Vendor Manifest implementation-url http://spark.apache.org/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.spark Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid spark-core_2.11 Highest Vendor pom artifactid spark-core_2.11 Low Vendor pom groupid org.apache.spark Highest Vendor pom name Spark Project Core High Vendor pom parent-artifactid spark-parent_2.11 Low Vendor pom url http://spark.apache.org/ Highest Product file name spark-core_2.11-2.4.5 High Product jar package name apache Highest Product jar package name http Highest Product jar package name spark Highest Product Manifest Implementation-Title Spark Project Core High Product Manifest implementation-url http://spark.apache.org/ Low Product Manifest specification-title Spark Project Core Medium Product pom artifactid spark-core_2.11 Highest Product pom groupid org.apache.spark Highest Product pom name Spark Project Core High Product pom parent-artifactid spark-parent_2.11 Medium Product pom url http://spark.apache.org/ Medium Version Manifest Implementation-Version 2.4.5 High Version pom version 2.4.5 Highest
Related Dependencies CVE-2018-17190 suppress
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-9480 suppress
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). CWE-306 Missing Authentication for Critical Function
CVSSv2:
Base Score: HIGH (9.3) Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-33891 suppress
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11804 suppress
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2021-38296 suppress
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later CWE-294 Authentication Bypass by Capture-replay
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2022-31777 suppress
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:
Base Score: MEDIUM (5.4) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-11770 suppress
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'. CWE-287 Improper Authentication
CVSSv2:
Base Score: MEDIUM (4.9) Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.2) Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions:
File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/additional-metrics.jsMD5: 7fa27b76aeb0681abb2e6fe720669baeSHA1: 7eb83bced737a22b17115be924b4400b444fdbdaSHA256: c40ff9923a081ba6fcfb125db5237d7e50a03198cae783c2b6aed8abbf8a5eedReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: additional-metrics.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/additional-metrics.js MD5: 7fa27b76aeb0681abb2e6fe720669bae SHA1: 7eb83bced737a22b17115be924b4400b444fdbda SHA256: c40ff9923a081ba6fcfb125db5237d7e50a03198cae783c2b6aed8abbf8a5eed File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/bootstrap-tooltip.jsMD5: 709947628312aa8a4abaaf4e164c4f2cSHA1: f4497d890717ded6be81af60dc211dd5528be2bdSHA256: 7b4898d4fe0ee9e363ded6e1fd5ea1302c400ccd35590b863c9c7d95de71a652Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: bootstrap-tooltip.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/bootstrap-tooltip.js MD5: 709947628312aa8a4abaaf4e164c4f2c SHA1: f4497d890717ded6be81af60dc211dd5528be2bd SHA256: 7b4898d4fe0ee9e363ded6e1fd5ea1302c400ccd35590b863c9c7d95de71a652 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/d3.min.jsMD5: e1b9f89cc778a8c619cde3aea8b6f9d4SHA1: 71188357fc005e40125b0ad76586c1f4bd53cffdSHA256: 3d4c7c277efd3bb019ed0aba5d2dfbe575ded9b9055b842997774bee02f2b76aReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: d3.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/d3.min.js MD5: e1b9f89cc778a8c619cde3aea8b6f9d4 SHA1: 71188357fc005e40125b0ad76586c1f4bd53cffd SHA256: 3d4c7c277efd3bb019ed0aba5d2dfbe575ded9b9055b842997774bee02f2b76a File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/dagre-d3.min.jsMD5: 2a602f00fd01dc07a0cb4def2f19850fSHA1: f7552c9cb333c9dfc81c01149f7c321ed95ae0efSHA256: f38a54a35b59d44f359e1ecdbccc457ebae3f37c5448fc007107081d518144a3Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: dagre-d3.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/dagre-d3.min.js MD5: 2a602f00fd01dc07a0cb4def2f19850f SHA1: f7552c9cb333c9dfc81c01149f7c321ed95ae0ef SHA256: f38a54a35b59d44f359e1ecdbccc457ebae3f37c5448fc007107081d518144a3 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/dataTables.bootstrap.min.jsMD5: 0b47c89e21f255c1dd714c4acf7ff89cSHA1: a66a9406643303fc2a33d53ab773e0a76ad49f5aSHA256: a905062b971bfb70ba70dda1a454d9cb7f7389be7ff515f6eb9009c8e697a34bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: dataTables.bootstrap.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/dataTables.bootstrap.min.js MD5: 0b47c89e21f255c1dd714c4acf7ff89c SHA1: a66a9406643303fc2a33d53ab773e0a76ad49f5a SHA256: a905062b971bfb70ba70dda1a454d9cb7f7389be7ff515f6eb9009c8e697a34b File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/dataTables.rowsGroup.jsMD5: 9473e0a904f35fdf0110d912d16d5fb7SHA1: 195a59175be1992aab636c5c641b405ba0283581SHA256: 5856c937e4fe8a921364a14de58f406788db336ed9066b3aed897c0ced755c42Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: dataTables.rowsGroup.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/dataTables.rowsGroup.js MD5: 9473e0a904f35fdf0110d912d16d5fb7 SHA1: 195a59175be1992aab636c5c641b405ba0283581 SHA256: 5856c937e4fe8a921364a14de58f406788db336ed9066b3aed897c0ced755c42 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/executorspage.jsMD5: 8f41b562277b66ed7b1d6228e3f2dd10SHA1: 911071fffe2a5448fd337c85d860ccf6d8c51d4fSHA256: 9b639b79d44f8942772a23b1758c23f26fb093172be4c807446ce21f5f28026cReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: executorspage.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/executorspage.js MD5: 8f41b562277b66ed7b1d6228e3f2dd10 SHA1: 911071fffe2a5448fd337c85d860ccf6d8c51d4f SHA256: 9b639b79d44f8942772a23b1758c23f26fb093172be4c807446ce21f5f28026c File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/graphlib-dot.min.jsMD5: 4c5ef7d11656cbc9c5efa082c2cc171aSHA1: 197289ce3c78118bdeae5f312f97ed2b76cbd367SHA256: 668584b1ed5fe082dc65c895d7cf4b4b3f0868758b1bdbaf056905418594a556Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: graphlib-dot.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/graphlib-dot.min.js MD5: 4c5ef7d11656cbc9c5efa082c2cc171a SHA1: 197289ce3c78118bdeae5f312f97ed2b76cbd367 SHA256: 668584b1ed5fe082dc65c895d7cf4b4b3f0868758b1bdbaf056905418594a556 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/historypage-common.jsMD5: d6dffdb2dd396a5f5f7b979cb94358f6SHA1: 0b4accc75a43b3cba74d27a2dcc931b3d959cc74SHA256: ca2aa7c8eb2d8a79ff69d47700f9faa55ea4269a95fdf1ec84f99ca988f7be61Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: historypage-common.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/historypage-common.js MD5: d6dffdb2dd396a5f5f7b979cb94358f6 SHA1: 0b4accc75a43b3cba74d27a2dcc931b3d959cc74 SHA256: ca2aa7c8eb2d8a79ff69d47700f9faa55ea4269a95fdf1ec84f99ca988f7be61 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/historypage.jsMD5: d9ffb809062db9c75b59c8c71ca0a41dSHA1: e58e27b549ddf1963c4fc89e00e59964fba729c4SHA256: 9a4fd5cf9b9ab32b55ea2fd35e2e121c894109785abe3ab3b1503908558227e6Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: historypage.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/historypage.js MD5: d9ffb809062db9c75b59c8c71ca0a41d SHA1: e58e27b549ddf1963c4fc89e00e59964fba729c4 SHA256: 9a4fd5cf9b9ab32b55ea2fd35e2e121c894109785abe3ab3b1503908558227e6 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/initialize-tooltips.jsMD5: a7d09087f6ad4fb363268e35875c039dSHA1: 5a3e6fade32d14c4607fabd6c3c687055aeb83d2SHA256: a1accf33abb4abb4a65359b042db1c6afd92e437aa7cd08cb914590f5dd92c88Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: initialize-tooltips.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/initialize-tooltips.js MD5: a7d09087f6ad4fb363268e35875c039d SHA1: 5a3e6fade32d14c4607fabd6c3c687055aeb83d2 SHA256: a1accf33abb4abb4a65359b042db1c6afd92e437aa7cd08cb914590f5dd92c88 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jquery-1.12.4.min.jsMD5: 4f252523d4af0b478c810c2547a63e19SHA1: 5a9dcfbef655a2668e78baebeaa8dc6f41d8dabbSHA256: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name jquery High Product file name jquery High Version file version 1.12.4.min High
Related Dependencies spark-core_2.12-2.4.5.jar: jquery-1.12.4.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jquery-1.12.4.min.js MD5: 4f252523d4af0b478c810c2547a63e19 SHA1: 5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb SHA256: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 pkg:javascript/jquery@1.12.4.min CVE-2015-9251 suppress
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* versions up to (excluding) 7.0.0.1 cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.0.4.0 cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* versions up to (excluding) 7.2 cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.1; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* versions from (including) 4.3.0.1; versions up to (including) 4.3.0.4 cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* CVE-2019-11358 suppress
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CWE-1321
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.11.0; versions up to (excluding) 1.11.9 cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* versions from (including) 1.12.0; versions up to (excluding) 1.12.6 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.66 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.5.0; versions up to (excluding) 8.5.15 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (excluding) 8.6.15 cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* versions from (including) 3.0.0; versions up to (including) 3.9.4 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions up to (excluding) 3.4.0 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 19.1 cpe:2.3:a:oracle:application_service_level_management:13.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_service_level_management:13.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.0; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_operations_monitor:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:diagnostic_assistant:2.12.36:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 7.3.3; versions up to (including) 7.3.5 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.5; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.5.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.2; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:financial_services_retail_customer_analytics:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.6 cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.4; versions up to (including) 8.0.7 cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_performance_insight:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper_and_adf:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:knowledge:*:*:*:*:*:*:*:* versions from (including) 8.6.0; versions up to (including) 8.6.3 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.15 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2.0; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:primavera_gateway:15.2.18:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* versions from (including) 17.7; versions up to (including) 17.12 cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:real-time_scheduler:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_mobile_applications:*:*:*:*:*:*:*:* versions up to (including) 19.8 cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:system_utilities:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:transportation_management:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_mobile_workforce_management:*:*:*:*:*:*:*:* versions from (including) 2.3.0.1; versions up to (including) 2.3.0.3 cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* CVE-2020-11022 suppress
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.2; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* versions from (including) 18.1; versions up to (including) 20.1 cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* versions up to (excluding) 21.1.2 cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* versions from (including) 8.0.0; versions up to (including) 8.2.2 cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* versions from (including) 8.0.6.0.0; versions up to (including) 8.1.0.0.0 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.8 cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.0.9 cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* versions from (including) 19.1.0; versions up to (including) 19.1.2 cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* versions from (including) 8.0.6; versions up to (including) 8.1.0 cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* versions from (including) 5.0.0.0; versions up to (including) 5.6.0.0 cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* versions from (including) 12.2.0; versions up to (including) 12.2.20 cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 CVE-2020-11023 suppress
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions (NVD):
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 7.0; versions up to (excluding) 7.70 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.7.0; versions up to (excluding) 8.7.14 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0; versions up to (excluding) 8.8.6 cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* versions from (including) 1.0.3; versions up to (excluding) 3.5.0 cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* versions from (including) 3.0; versions up to (including) 3.1.3 cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* versions up to (excluding) 20.2 cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* versions from (including) 2.7.0; versions up to (including) 2.8.0 cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* versions from (including) 2.4.0; versions up to (including) 2.10.0 cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* versions from (including) 16.1.0; versions up to (including) 16.4.0 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* versions from (including) 6.1; versions up to (including) 6.4 cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* versions from (including) 4.1; versions up to (including) 4.3 cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.0 cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* versions up to (excluding) 2.12.41 cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 16.2; versions up to (including) 16.2.11 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 17.12.0; versions up to (including) 17.12.7 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 18.8.0; versions up to (including) 18.8.9 cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* versions from (including) 19.12.0; versions up to (including) 19.12.4 cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:* versions up to (including) 20.12 cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jquery.blockUI.min.jsMD5: d8199c4bdb9f8a6bdfb27f3e3e4d1385SHA1: 2accb3541d62d724734aa65cbb7a8f6dc959b00eSHA256: 5b6f08f589840a27b74ec78944a46aa55e58812a99c5aa634aed6b45041a1761Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: jquery.blockUI.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jquery.blockUI.min.js MD5: d8199c4bdb9f8a6bdfb27f3e3e4d1385 SHA1: 2accb3541d62d724734aa65cbb7a8f6dc959b00e SHA256: 5b6f08f589840a27b74ec78944a46aa55e58812a99c5aa634aed6b45041a1761 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jquery.cookies.2.2.0.min.jsMD5: 03b9574487d06f8f8513f95758c7cab3SHA1: 90a61ac9835905ebec2bb1499dd0b0de894f8045SHA256: 10fdbfbb18a947e7024457f52fd2dfe94ebddd612156c886731474b02aa45d23Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: jquery.cookies.2.2.0.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jquery.cookies.2.2.0.min.js MD5: 03b9574487d06f8f8513f95758c7cab3 SHA1: 90a61ac9835905ebec2bb1499dd0b0de894f8045 SHA256: 10fdbfbb18a947e7024457f52fd2dfe94ebddd612156c886731474b02aa45d23 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jquery.dataTables.1.10.18.min.jsMD5: 7b395d818b854ed93638578031d0874eSHA1: 39398e2f7984f61c8bfa1589e4adbe774271ff9bSHA256: 2ad40bb3c5f0b5e598d833478e241f9f3b1cbc16aec3ad44b0e0cad32cb6114eReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: jquery.dataTables.1.10.18.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jquery.dataTables.1.10.18.min.js MD5: 7b395d818b854ed93638578031d0874e SHA1: 39398e2f7984f61c8bfa1589e4adbe774271ff9b SHA256: 2ad40bb3c5f0b5e598d833478e241f9f3b1cbc16aec3ad44b0e0cad32cb6114e File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jquery.mustache.jsMD5: a8678316d7ed318e27e453ccf58bc214SHA1: 8662bfee6a48f878cfcb783c512359ab6f47afbdSHA256: 2a4f4169e59d11cca8e24b0f44784f803c9e7724f0c0f09b73381c228093be5bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: jquery.mustache.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jquery.mustache.js MD5: a8678316d7ed318e27e453ccf58bc214 SHA1: 8662bfee6a48f878cfcb783c512359ab6f47afbd SHA256: 2a4f4169e59d11cca8e24b0f44784f803c9e7724f0c0f09b73381c228093be5b File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/jsonFormatter.min.jsMD5: beca83ee888fc4e974d0069b5e94b6eaSHA1: 0795631699a4d227e3cf13398792d54c0f4e4eb2SHA256: 182aaeba495cc66257d9c46ea68df28139bd6f02eb97695341ef4dae69dd0539Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: jsonFormatter.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/jsonFormatter.min.js MD5: beca83ee888fc4e974d0069b5e94b6ea SHA1: 0795631699a4d227e3cf13398792d54c0f4e4eb2 SHA256: 182aaeba495cc66257d9c46ea68df28139bd6f02eb97695341ef4dae69dd0539 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/log-view.jsMD5: efe8661ce20a440c0cef49fd2065a619SHA1: 209be33395581d7910508e7d5fbcf34128276410SHA256: 70aa723cc996ac25cf0e33914fec32545cd6013f4cab35ed1d031d26ab3508d4Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: log-view.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/log-view.js MD5: efe8661ce20a440c0cef49fd2065a619 SHA1: 209be33395581d7910508e7d5fbcf34128276410 SHA256: 70aa723cc996ac25cf0e33914fec32545cd6013f4cab35ed1d031d26ab3508d4 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/sorttable.jsMD5: 8d85fe2d93f0c9e2823b9ecc00094a00SHA1: 04cfb707c2bb77b50f3dc87ce3e78646f4765d30SHA256: 94761e7b1c4ad7423a09f334f6a2fa6e6ac2faf354ced60984a0b88f423f95f3Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: sorttable.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/sorttable.js MD5: 8d85fe2d93f0c9e2823b9ecc00094a00 SHA1: 04cfb707c2bb77b50f3dc87ce3e78646f4765d30 SHA256: 94761e7b1c4ad7423a09f334f6a2fa6e6ac2faf354ced60984a0b88f423f95f3 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/spark-dag-viz.jsMD5: 5bd6afd0f6a84724900815d9bca46579SHA1: c02bc10e545436dae6b5cd3a1b59b25d614cfdc9SHA256: 8797a36ba1d907c2203ccff6315db6a5385e9c2fc259925eb2cb2dd288c86c7cReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: spark-dag-viz.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/spark-dag-viz.js MD5: 5bd6afd0f6a84724900815d9bca46579 SHA1: c02bc10e545436dae6b5cd3a1b59b25d614cfdc9 SHA256: 8797a36ba1d907c2203ccff6315db6a5385e9c2fc259925eb2cb2dd288c86c7c File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/table.jsMD5: a5898f0bcd5ec1686d1d72f47c524909SHA1: 33a086242b5716193ce7382be92e4e25fc0c47d1SHA256: 0fd719ead123ad6eacae5373bb1ccb7fd6339ea816adcaceae822f8d578e21c6Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: table.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/table.js MD5: a5898f0bcd5ec1686d1d72f47c524909 SHA1: 33a086242b5716193ce7382be92e4e25fc0c47d1 SHA256: 0fd719ead123ad6eacae5373bb1ccb7fd6339ea816adcaceae822f8d578e21c6 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/timeline-view.jsMD5: fe77e2089d19861ca0278a001d52f195SHA1: 77c61492434d964e5f4422fed65060c348228ae8SHA256: e504907cf922602b0b06a860eadaa88fe2c3eafdc4a6e7f4f95e50ba68335faaReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: timeline-view.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/timeline-view.js MD5: fe77e2089d19861ca0278a001d52f195 SHA1: 77c61492434d964e5f4422fed65060c348228ae8 SHA256: e504907cf922602b0b06a860eadaa88fe2c3eafdc4a6e7f4f95e50ba68335faa File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/utils.jsMD5: 6a10332e5ee728f81289ab6b986383eaSHA1: bb009d0572015214f8be488976108507c2d1a062SHA256: d926f4c3e7a66932458f62b53d3e87790989f4c7096b2a19ffbfa19ef70eaba5Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: utils.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/utils.js MD5: 6a10332e5ee728f81289ab6b986383ea SHA1: bb009d0572015214f8be488976108507c2d1a062 SHA256: d926f4c3e7a66932458f62b53d3e87790989f4c7096b2a19ffbfa19ef70eaba5 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/vis.min.jsMD5: 8f16db863f54b83e1a0a33d2b2249c79SHA1: 15c8115cdd5e9d70183f7995aa84a8c498c5a5e6SHA256: 7b461b95eaf9aedbb6e4765a2913a75ffe086d8c5b45d12c18a96fd43c55edc4Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: vis.min.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/vis.min.js MD5: 8f16db863f54b83e1a0a33d2b2249c79 SHA1: 15c8115cdd5e9d70183f7995aa84a8c498c5a5e6 SHA256: 7b461b95eaf9aedbb6e4765a2913a75ffe086d8c5b45d12c18a96fd43c55edc4 File Path: /root/.m2/repository/org/apache/spark/spark-core_2.11/2.4.5/spark-core_2.11-2.4.5.jar/org/apache/spark/ui/static/webui.jsMD5: 0beb65aa7b4fe9189c2a1e7fc8f18e42SHA1: a947d3df6dec086cbf63e5c70e78b65cac35cf23SHA256: e36e5d356aab1681f84aad982cc66ef3301ccdbba9d1c0ee4717408d200d616bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-core_2.12-2.4.5.jar: webui.jsFile Path: /root/.m2/repository/org/apache/spark/spark-core_2.12/2.4.5/spark-core_2.12-2.4.5.jar/org/apache/spark/ui/static/webui.js MD5: 0beb65aa7b4fe9189c2a1e7fc8f18e42 SHA1: a947d3df6dec086cbf63e5c70e78b65cac35cf23 SHA256: e36e5d356aab1681f84aad982cc66ef3301ccdbba9d1c0ee4717408d200d616b File Path: /root/.m2/repository/org/apache/spark/spark-hive_2.11/2.4.5/spark-hive_2.11-2.4.5.jarMD5: 1817637846469cc1aebd80b3d2d61011SHA1: a0fc06e7331a2ffaa4191d3c88bcacfd0665c696SHA256: fdd7d5f29fd3af6a3148b769377ceedc5813d2f9d8502ff1f39c41518c6d090aReferenced In Projects/Scopes:
livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name spark-hive_2.11-2.4.5 High Vendor jar package name apache Highest Vendor jar package name hive Highest Vendor jar package name spark Highest Vendor Manifest implementation-url http://spark.apache.org/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.spark Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid spark-hive_2.11 Highest Vendor pom artifactid spark-hive_2.11 Low Vendor pom groupid org.apache.spark Highest Vendor pom name Spark Project Hive High Vendor pom parent-artifactid spark-parent_2.11 Low Vendor pom url http://spark.apache.org/ Highest Product file name spark-hive_2.11-2.4.5 High Product jar package name apache Highest Product jar package name hive Highest Product jar package name spark Highest Product Manifest Implementation-Title Spark Project Hive High Product Manifest implementation-url http://spark.apache.org/ Low Product Manifest specification-title Spark Project Hive Medium Product pom artifactid spark-hive_2.11 Highest Product pom groupid org.apache.spark Highest Product pom name Spark Project Hive High Product pom parent-artifactid spark-parent_2.11 Medium Product pom url http://spark.apache.org/ Medium Version Manifest Implementation-Version 2.4.5 High Version pom version 2.4.5 Highest
Related Dependencies spark-hive_2.12-2.4.5.jarFile Path: /root/.m2/repository/org/apache/spark/spark-hive_2.12/2.4.5/spark-hive_2.12-2.4.5.jar MD5: ba0d4be9acd5ef67643247c7e0ccee8e SHA1: 6a4c9b09c863cd3c211413a0ec006fc273f361f8 SHA256: 75950e2c9568f6ef165c07b68a40de8e141a039452f24307515c260777a748cb pkg:maven/org.apache.spark/spark-hive_2.12@2.4.5 CVE-2018-17190 suppress
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-9480 suppress
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). CWE-306 Missing Authentication for Critical Function
CVSSv2:
Base Score: HIGH (9.3) Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-33891 suppress
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-4125 suppress
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11804 suppress
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2020-13949 suppress
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2021-34538 suppress
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. CWE-306 Missing Authentication for Critical Function
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
CVE-2021-38296 suppress
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later CWE-294 Authentication Bypass by Capture-replay
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2022-31777 suppress
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:
Base Score: MEDIUM (5.4) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-11770 suppress
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'. CWE-287 Improper Authentication
CVSSv2:
Base Score: MEDIUM (4.9) Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.2) Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions:
Description:
JPMML class model License:
BSD 3-Clause License: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/apache/spark/spark-mllib_2.11/2.4.5/spark-mllib_2.11-2.4.5.jar/META-INF/maven/org.jpmml/pmml-model/pom.xml
MD5: ea46ab07e3bc3397ca24b9a0d684a8fd
SHA1: 5678af1ade1a35bbe213ffebe7e8a2f3ec29a615
SHA256: 85b54b25181fc6fc8527aecf470f0b095d7f45a98e567dae10a106d53898e0b7
Referenced In Projects/Scopes: livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor pom artifactid pmml-model Low Vendor pom groupid org.jpmml Highest Vendor pom name JPMML class model High Vendor pom parent-artifactid jpmml-model Low Product pom artifactid pmml-model Highest Product pom groupid org.jpmml Highest Product pom name JPMML class model High Product pom parent-artifactid jpmml-model Medium Version pom version 1.2.15 Highest
Related Dependencies spark-mllib_2.12-2.4.5.jar (shaded: org.jpmml:pmml-model:1.2.15)File Path: /root/.m2/repository/org/apache/spark/spark-mllib_2.12/2.4.5/spark-mllib_2.12-2.4.5.jar/META-INF/maven/org.jpmml/pmml-model/pom.xml MD5: ea46ab07e3bc3397ca24b9a0d684a8fd SHA1: 5678af1ade1a35bbe213ffebe7e8a2f3ec29a615 SHA256: 85b54b25181fc6fc8527aecf470f0b095d7f45a98e567dae10a106d53898e0b7 pkg:maven/org.jpmml/pmml-model@1.2.15 Description:
JPMML schema annotations for class model License:
BSD 3-Clause License: http://opensource.org/licenses/BSD-3-Clause File Path: /root/.m2/repository/org/apache/spark/spark-mllib_2.11/2.4.5/spark-mllib_2.11-2.4.5.jar/META-INF/maven/org.jpmml/pmml-schema/pom.xml
MD5: e48f897f27355474a94bbe0be8f210d1
SHA1: 52540b943355975f6e9ae84e31955f7117983c71
SHA256: a606562fee742b5f8eb7fc587f9132fa19b19428f267ff770c300285dd0a8899
Referenced In Projects/Scopes: livy-repl_2.12:provided livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor pom artifactid pmml-schema Low Vendor pom groupid org.jpmml Highest Vendor pom name JPMML schema High Vendor pom parent-artifactid jpmml-model Low Product pom artifactid pmml-schema Highest Product pom groupid org.jpmml Highest Product pom name JPMML schema High Product pom parent-artifactid jpmml-model Medium Version pom version 1.2.15 Highest
Related Dependencies spark-mllib_2.12-2.4.5.jar (shaded: org.jpmml:pmml-schema:1.2.15)File Path: /root/.m2/repository/org/apache/spark/spark-mllib_2.12/2.4.5/spark-mllib_2.12-2.4.5.jar/META-INF/maven/org.jpmml/pmml-schema/pom.xml MD5: e48f897f27355474a94bbe0be8f210d1 SHA1: 52540b943355975f6e9ae84e31955f7117983c71 SHA256: a606562fee742b5f8eb7fc587f9132fa19b19428f267ff770c300285dd0a8899 pkg:maven/org.jpmml/pmml-schema@1.2.15 Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
Guava has two code dependencies - javax.annotation
per the JSR-305 spec and javax.inject per the JSR-330 spec.
File Path: /root/.m2/repository/org/apache/spark/spark-network-common_2.11/2.4.5/spark-network-common_2.11-2.4.5.jar/META-INF/maven/com.google.guava/guava/pom.xmlMD5: b9406eec5781ea391a26972c394bf129SHA1: 7b4c8f117c11a8f1fcaf4f1b0fd07cbe756a1430SHA256: 3dd4a992d53eb524a1c6546a24b853b332b26520755e26b25d38100131424b7bReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid guava Low Vendor pom groupid com.google.guava Highest Vendor pom name Guava: Google Core Libraries for Java High Vendor pom parent-artifactid guava-parent Low Product pom artifactid guava Highest Product pom groupid com.google.guava Highest Product pom name Guava: Google Core Libraries for Java High Product pom parent-artifactid guava-parent Medium Version pom version 14.0.1 Highest
Related Dependencies spark-network-common_2.12-2.4.5.jar (shaded: com.google.guava:guava:14.0.1)File Path: /root/.m2/repository/org/apache/spark/spark-network-common_2.12/2.4.5/spark-network-common_2.12-2.4.5.jar/META-INF/maven/com.google.guava/guava/pom.xml MD5: b9406eec5781ea391a26972c394bf129 SHA1: 7b4c8f117c11a8f1fcaf4f1b0fd07cbe756a1430 SHA256: 3dd4a992d53eb524a1c6546a24b853b332b26520755e26b25d38100131424b7b pkg:maven/com.google.guava/guava@14.0.1 CVE-2018-10237 suppress
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. CWE-770 Allocation of Resources Without Limits or Throttling
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H References:
CONFIRM - https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion CONFIRM - https://security.netapp.com/advisory/ntap-20220629-0008/ MISC - https://www.oracle.com/security-alerts/cpujan2021.html MISC - https://www.oracle.com/security-alerts/cpujul2020.html MISC - https://www.oracle.com/security-alerts/cpuoct2021.html MLIST - [activemq-gitbox] 20190530 [GitHub] [activemq-artemis] brusdev opened a new pull request #2687: ARTEMIS-2359 Upgrade to Guava 24.1 MLIST - [activemq-issues] 20190516 [jira] [Created] (AMQ-7208) Security Issue related to Guava 18.0 MLIST - [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar MLIST - [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version MLIST - [cassandra-commits] 20190612 [jira] [Assigned] (CASSANDRA-14760) CVE-2018-10237 Security vulnerability in 3.11.3 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200206 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200211 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] andrei-ivanov commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [cxf-dev] 20200420 [GitHub] [cxf] reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237 MLIST - [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities MLIST - [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities MLIST - [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [flink-dev] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200806 [jira] [Created] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20200814 [jira] [Commented] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-issues] 20210212 [jira] [Closed] (FLINK-18841) CVE-2018-10237 and CWE-400 occurred in flink dependency MLIST - [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version MLIST - [hadoop-common-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [hadoop-common-dev] 20200623 Update guava to 27.0-jre in hadoop branch-2.10 MLIST - [hadoop-hdfs-dev] 20190401 Update guava to 27.0-jre in hadoop-project MLIST - [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka MLIST - [lucene-issues] 20201022 [jira] [Created] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Resolved] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [lucene-issues] 20201022 [jira] [Updated] (SOLR-14960) Solr-clustering is bringing in CVE-2018-10237 vulnerable guava MLIST - [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core MLIST - [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 MLIST - [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities MLIST - [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes MLIST - [storm-issues] 20210315 [jira] [Created] (STORM-3754) Upgrade Guava version because of security vulnerability MLIST - [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? N/A - N/A OSSINDEX - [CVE-2018-10237] CWE-770: Allocation of Resources Without Limits or Throttling OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10237 OSSIndex - https://blog.sonatype.com/2018/11/welcome-back-to-nexus-intelligence-insights/ OSSIndex - https://github.com/google/guava/wiki/CVE-2018-10237 OSSIndex - https://www.securityfocus.com/bid/104133/references REDHAT - RHSA-2018:2423 REDHAT - RHSA-2018:2424 REDHAT - RHSA-2018:2425 REDHAT - RHSA-2018:2428 REDHAT - RHSA-2018:2598 REDHAT - RHSA-2018:2643 REDHAT - RHSA-2018:2740 REDHAT - RHSA-2018:2741 REDHAT - RHSA-2018:2742 REDHAT - RHSA-2018:2743 REDHAT - RHSA-2018:2927 REDHAT - RHSA-2019:2858 REDHAT - RHSA-2019:3149 SECTRACK - 1041707 Vulnerable Software & Versions: (show all )
CVE-2020-8908 suppress
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
File Path: /root/.m2/repository/org/apache/spark/spark-sql_2.11/2.4.5/spark-sql_2.11-2.4.5.jarMD5: debd29be2fd993c4f4c40fc64c79079dSHA1: f5cb7af2983ff36d629c37f19ea30db640714ec2SHA256: aa7a3f9913f82dc4380b5676e7dd684548f56b148cf856c068dbc38a841c123bReferenced In Projects/Scopes:
livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name spark-sql_2.11-2.4.5 High Vendor jar package name apache Highest Vendor jar package name spark Highest Vendor jar package name sql Highest Vendor Manifest implementation-url http://spark.apache.org/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache.spark Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid spark-sql_2.11 Highest Vendor pom artifactid spark-sql_2.11 Low Vendor pom groupid org.apache.spark Highest Vendor pom name Spark Project SQL High Vendor pom parent-artifactid spark-parent_2.11 Low Vendor pom url http://spark.apache.org/ Highest Product file name spark-sql_2.11-2.4.5 High Product jar package name apache Highest Product jar package name spark Highest Product jar package name sql Highest Product Manifest Implementation-Title Spark Project SQL High Product Manifest implementation-url http://spark.apache.org/ Low Product Manifest specification-title Spark Project SQL Medium Product pom artifactid spark-sql_2.11 Highest Product pom groupid org.apache.spark Highest Product pom name Spark Project SQL High Product pom parent-artifactid spark-parent_2.11 Medium Product pom url http://spark.apache.org/ Medium Version Manifest Implementation-Version 2.4.5 High Version pom version 2.4.5 Highest
Related Dependencies spark-sql_2.12-2.4.5.jarFile Path: /root/.m2/repository/org/apache/spark/spark-sql_2.12/2.4.5/spark-sql_2.12-2.4.5.jar MD5: 5c3d569f652f5aa5a59f1963202aac30 SHA1: 60b5466b07b4858119ccf4a7eda17f8bdb1d84fe SHA256: 09bb18c975d086c8969410186ce543798016e42b95c0c3334e5de93ee1aebd4e pkg:maven/org.apache.spark/spark-sql_2.12@2.4.5 CVE-2018-17190 suppress
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
CVE-2020-9480 suppress
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). CWE-306 Missing Authentication for Critical Function
CVSSv2:
Base Score: HIGH (9.3) Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2022-33891 suppress
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-11804 suppress
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code. CWE-20 Improper Input Validation
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2021-38296 suppress
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later CWE-294 Authentication Bypass by Capture-replay
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
CVE-2022-31777 suppress
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:
Base Score: MEDIUM (5.4) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2018-11770 suppress
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'. CWE-287 Improper Authentication
CVSSv2:
Base Score: MEDIUM (4.9) Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.2) Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions:
File Path: /root/.m2/repository/org/apache/spark/spark-sql_2.11/2.4.5/spark-sql_2.11-2.4.5.jar/org/apache/spark/sql/execution/ui/static/spark-sql-viz.jsMD5: b0f96c132acf2e1af7cfdf81e35d4554SHA1: 4fdb3cadde3fe6f7040ee82330551e3a145d98d2SHA256: 881405934698972ffb239581833e4b976e9bac3900428ea351d73dc22abf9d48Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-sql_2.12-2.4.5.jar: spark-sql-viz.jsFile Path: /root/.m2/repository/org/apache/spark/spark-sql_2.12/2.4.5/spark-sql_2.12-2.4.5.jar/org/apache/spark/sql/execution/ui/static/spark-sql-viz.js MD5: b0f96c132acf2e1af7cfdf81e35d4554 SHA1: 4fdb3cadde3fe6f7040ee82330551e3a145d98d2 SHA256: 881405934698972ffb239581833e4b976e9bac3900428ea351d73dc22abf9d48 File Path: /root/.m2/repository/org/apache/spark/spark-streaming_2.11/2.4.5/spark-streaming_2.11-2.4.5.jar/org/apache/spark/streaming/ui/static/streaming-page.jsMD5: 8f2c8e93e82ee62b0e68c525a4a1f69fSHA1: 5bc61284a596e1ebc1c62080169c37d14e3ef3f6SHA256: 056120555f8925fb000591f5b7f4e2eedb086b7958c29625671b95f4c8e4ad9cReferenced In Projects/Scopes:
livy-examples:provided livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-api:provided Evidence Type Source Name Value Confidence
Related Dependencies spark-streaming_2.12-2.4.5.jar: streaming-page.jsFile Path: /root/.m2/repository/org/apache/spark/spark-streaming_2.12/2.4.5/spark-streaming_2.12-2.4.5.jar/org/apache/spark/streaming/ui/static/streaming-page.js MD5: 8f2c8e93e82ee62b0e68c525a4a1f69f SHA1: 5bc61284a596e1ebc1c62080169c37d14e3ef3f6 SHA256: 056120555f8925fb000591f5b7f4e2eedb086b7958c29625671b95f4c8e4ad9c Description:
macros License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/spire-math/spire-macros_2.11/0.13.0/spire-macros_2.11-0.13.0.jar
MD5: d8c010ccced0a06707175b1c7e4a1aac
SHA1: 17059a17d2ee67ffd7eeaa825e68c9732cecf15a
SHA256: a8f79a0b05c2c5c915eafbf060aacea7af85b8f45f0d88ebe99251fc97477f08
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name spire-macros_2.11-0.13.0 High Vendor jar package name macros Highest Vendor jar package name spire Highest Vendor Manifest implementation-url http://spire-math.org Low Vendor Manifest Implementation-Vendor org.spire-math High Vendor Manifest Implementation-Vendor-Id org.spire-math Medium Vendor Manifest specification-vendor org.spire-math Low Vendor pom artifactid spire-macros_2.11 Highest Vendor pom artifactid spire-macros_2.11 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.spire-math Highest Vendor pom name macros High Vendor pom organization name org.spire-math High Vendor pom organization url http://spire-math.org Medium Vendor pom url http://spire-math.org Highest Product file name spire-macros_2.11-0.13.0 High Product jar package name macros Highest Product jar package name spire Highest Product Manifest Implementation-Title macros High Product Manifest implementation-url http://spire-math.org Low Product Manifest specification-title macros Medium Product pom artifactid spire-macros_2.11 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.spire-math Highest Product pom name macros High Product pom organization name org.spire-math Low Product pom organization url http://spire-math.org Low Product pom url http://spire-math.org Medium Version Manifest Implementation-Version 0.13.0 High Version pom version 0.13.0 Highest
Description:
macros License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/spire-math/spire-macros_2.12/0.13.0/spire-macros_2.12-0.13.0.jar
MD5: e78738c28404e963cdc6eb7582c04847
SHA1: 2276ac9864b9209049fdc2a151352ccffebe4bad
SHA256: c0cc92326a85384b83fce3d9fceae12cb23cf4f24168c5d1f3f04d62ccf4afa5
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name spire-macros_2.12-0.13.0 High Vendor jar package name macros Highest Vendor jar package name spire Highest Vendor Manifest implementation-url http://spire-math.org Low Vendor Manifest Implementation-Vendor org.spire-math High Vendor Manifest Implementation-Vendor-Id org.spire-math Medium Vendor Manifest specification-vendor org.spire-math Low Vendor pom artifactid spire-macros_2.12 Highest Vendor pom artifactid spire-macros_2.12 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.spire-math Highest Vendor pom name macros High Vendor pom organization name org.spire-math High Vendor pom organization url http://spire-math.org Medium Vendor pom url http://spire-math.org Highest Product file name spire-macros_2.12-0.13.0 High Product jar package name macros Highest Product jar package name spire Highest Product Manifest Implementation-Title macros High Product Manifest implementation-url http://spire-math.org Low Product Manifest specification-title macros Medium Product pom artifactid spire-macros_2.12 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.spire-math Highest Product pom name macros High Product pom organization name org.spire-math Low Product pom organization url http://spire-math.org Low Product pom url http://spire-math.org Medium Version Manifest Implementation-Version 0.13.0 High Version pom version 0.13.0 Highest
Description:
core License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/spire-math/spire_2.11/0.13.0/spire_2.11-0.13.0.jar
MD5: 3ff6c074cee4905bc0472098a3c13a95
SHA1: 32f131bf5002a637fbe9b1b9417a66aaad67bc5e
SHA256: 92381b2555e691bf25d7a987c24f0487a10940b6562cf51056c11052e4f1e5eb
Referenced In Projects/Scopes: livy-repl-parent:provided livy-repl_2.11:provided Evidence Type Source Name Value Confidence Vendor file name spire_2.11-0.13.0 High Vendor jar package name math Highest Vendor jar package name spire Highest Vendor Manifest implementation-url http://spire-math.org Low Vendor Manifest Implementation-Vendor org.spire-math High Vendor Manifest Implementation-Vendor-Id org.spire-math Medium Vendor Manifest specification-vendor org.spire-math Low Vendor pom artifactid spire_2.11 Highest Vendor pom artifactid spire_2.11 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.spire-math Highest Vendor pom name core High Vendor pom organization name org.spire-math High Vendor pom organization url http://spire-math.org Medium Vendor pom url http://spire-math.org Highest Product file name spire_2.11-0.13.0 High Product jar package name math Highest Product jar package name spire Highest Product Manifest Implementation-Title core High Product Manifest implementation-url http://spire-math.org Low Product Manifest specification-title core Medium Product pom artifactid spire_2.11 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.spire-math Highest Product pom name core High Product pom organization name org.spire-math Low Product pom organization url http://spire-math.org Low Product pom url http://spire-math.org Medium Version Manifest Implementation-Version 0.13.0 High Version pom version 0.13.0 Highest
Description:
core License:
MIT: http://opensource.org/licenses/MIT File Path: /root/.m2/repository/org/spire-math/spire_2.12/0.13.0/spire_2.12-0.13.0.jar
MD5: 3fb9b7fd4352f4ca501bbc15498e424a
SHA1: 28b4a0b11618f82ded3d34ef58292c6c93d7550d
SHA256: 63b4b858904e855f3961fc783d3138a44f8b6bf4ed0254d02c9638978d0bb202
Referenced In Project/Scope: livy-repl_2.12:provided
Evidence Type Source Name Value Confidence Vendor file name spire_2.12-0.13.0 High Vendor jar package name math Highest Vendor jar package name spire Highest Vendor Manifest implementation-url http://spire-math.org Low Vendor Manifest Implementation-Vendor org.spire-math High Vendor Manifest Implementation-Vendor-Id org.spire-math Medium Vendor Manifest specification-vendor org.spire-math Low Vendor pom artifactid spire_2.12 Highest Vendor pom artifactid spire_2.12 Low Vendor pom developer id d_m Medium Vendor pom developer id tixxit Medium Vendor pom developer name Erik Osheim Medium Vendor pom developer name Tom Switzer Medium Vendor pom groupid org.spire-math Highest Vendor pom name core High Vendor pom organization name org.spire-math High Vendor pom organization url http://spire-math.org Medium Vendor pom url http://spire-math.org Highest Product file name spire_2.12-0.13.0 High Product jar package name math Highest Product jar package name spire Highest Product Manifest Implementation-Title core High Product Manifest implementation-url http://spire-math.org Low Product Manifest specification-title core Medium Product pom artifactid spire_2.12 Highest Product pom developer id d_m Low Product pom developer id tixxit Low Product pom developer name Erik Osheim Low Product pom developer name Tom Switzer Low Product pom groupid org.spire-math Highest Product pom name core High Product pom organization name org.spire-math Low Product pom organization url http://spire-math.org Low Product pom url http://spire-math.org Medium Version Manifest Implementation-Version 0.13.0 High Version pom version 0.13.0 Highest
Description:
StAX is a standard XML processing API that allows you to stream XML data from and to your application.
License:
GNU General Public Library: http://www.gnu.org/licenses/gpl.txt
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: http://www.sun.com/cddl/cddl.html File Path: /root/.m2/repository/javax/xml/stream/stax-api/1.0-2/stax-api-1.0-2.jar
MD5: 7d18b63063580284c3f5734081fdc99f
SHA1: d6337b0de8b25e53e81b922352fbea9f9f57ba0b
SHA256: e8c70ebd76f982c9582a82ef82cf6ce14a7d58a4a4dca5cb7b7fc988c80089b7
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name stax-api High Vendor jar package name javax Highest Vendor jar package name javax Low Vendor jar package name stream Highest Vendor jar package name stream Low Vendor jar package name xml Highest Vendor jar package name xml Low Vendor pom artifactid stax-api Highest Vendor pom artifactid stax-api Low Vendor pom groupid javax.xml.stream Highest Vendor pom name Streaming API for XML High Product file name stax-api High Product jar package name javax Highest Product jar package name stream Highest Product jar package name stream Low Product jar package name xml Highest Product jar package name xml Low Product pom artifactid stax-api Highest Product pom groupid javax.xml.stream Highest Product pom name Streaming API for XML High Version pom version 1.0-2 Highest
Description:
StAX API is the standard java XML processing API defined by JSR-173 License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/stax/stax-api/1.0.1/stax-api-1.0.1.jar
MD5: 7d436a53c64490bee564c576babb36b4
SHA1: 49c100caf72d658aca8e58bd74a4ba90fa2b0d70
SHA256: d1968436fc216c901fb9b82c7e878b50fd1d30091676da95b2edd3a9c0ccf92e
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name stax-api High Vendor jar package name xml Highest Vendor Manifest Implementation-Vendor JCP High Vendor Manifest specification-vendor JCP-173 Low Vendor pom artifactid stax-api Highest Vendor pom artifactid stax-api Low Vendor pom developer id aslom Medium Vendor pom developer id chris Medium Vendor pom developer name Aleksander Slominski Medium Vendor pom developer name Chris Fry Medium Vendor pom developer org Indiana University Medium Vendor pom groupid stax Highest Vendor pom name StAX API High Vendor pom url http://stax.codehaus.org/ Highest Product file name stax-api High Product jar package name xml Highest Product Manifest Implementation-Title StAX 1.0 API High Product Manifest specification-title StAX Medium Product pom artifactid stax-api Highest Product pom developer id aslom Low Product pom developer id chris Low Product pom developer name Aleksander Slominski Low Product pom developer name Chris Fry Low Product pom developer org Indiana University Low Product pom groupid stax Highest Product pom name StAX API High Product pom url http://stax.codehaus.org/ Medium Version file version 1.0.1 High Version Manifest Implementation-Version 1.0.1 High Version pom version 1.0.1 Highest
Description:
A library for summarizing data in streams for which it is infeasible to store all events License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/clearspring/analytics/stream/2.7.0/stream-2.7.0.jar
MD5: 02fc1abdf3c14a1d759c3ac799b54cec
SHA1: 9998f8cf87d329fef226405f8d519638cfe1431d
SHA256: eb66267be63bba45f3e9d4e143bc32906db595dbbedafb62842e7ea340796e01
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name stream High Vendor jar package name analytics Highest Vendor jar package name analytics Low Vendor jar package name clearspring Highest Vendor jar package name clearspring Low Vendor jar package name stream Highest Vendor jar package name stream Low Vendor pom artifactid stream Highest Vendor pom artifactid stream Low Vendor pom developer email abramsm@addthis.com Low Vendor pom developer email christopher@addthis.com Low Vendor pom developer name Chris Burroughs Medium Vendor pom developer name Matt Abrams Medium Vendor pom groupid com.clearspring.analytics Highest Vendor pom name stream-lib High Vendor pom url addthis/stream-lib Highest Product file name stream High Product jar package name analytics Highest Product jar package name analytics Low Product jar package name clearspring Highest Product jar package name stream Highest Product jar package name stream Low Product pom artifactid stream Highest Product pom developer email abramsm@addthis.com Low Product pom developer email christopher@addthis.com Low Product pom developer name Chris Burroughs Low Product pom developer name Matt Abrams Low Product pom groupid com.clearspring.analytics Highest Product pom name stream-lib High Product pom url addthis/stream-lib High Version file version 2.7.0 High Version pom version 2.7.0 Highest
Description:
StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output.
StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization.
It evolved over years of effort developing jGuru.com.
StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic
is that unlike other engines, it strictly enforces model-view separation.
Strict separation makes websites and code generators more flexible
and maintainable; it also provides an excellent defense against malicious
template authors.
There are currently about 600 StringTemplate source downloads a month.
License:
BSD licence: http://antlr.org/license.html File Path: /root/.m2/repository/org/antlr/stringtemplate/3.2.1/stringtemplate-3.2.1.jar
MD5: b58ca53e518a92a1991eb63b61917582
SHA1: 59ec8083721eae215c6f3caee944c410d2be34de
SHA256: f66ce72e965e5301cb0f020e54d2ba6ad76feb91b3cbfc30dbbf00c06a6df6d7
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name stringtemplate High Vendor jar package name antlr Highest Vendor jar package name antlr Low Vendor jar package name language Low Vendor jar package name stringtemplate Highest Vendor jar package name stringtemplate Low Vendor pom artifactid stringtemplate Highest Vendor pom artifactid stringtemplate Low Vendor pom developer email jimi@temporal-wave.com Low Vendor pom developer email parrt@antlr.org Low Vendor pom developer name Jim Idle Medium Vendor pom developer name Terence Parr Medium Vendor pom developer org Temporal Wave LLC Medium Vendor pom developer org USFCA Medium Vendor pom developer org URL http://www.cs.usfca.edu Medium Vendor pom developer org URL http://www.temporal-wave.com Medium Vendor pom groupid org.antlr Highest Vendor pom name ANTLR StringTemplate High Vendor pom url http://www.stringtemplate.org Highest Product file name stringtemplate High Product jar package name antlr Highest Product jar package name language Low Product jar package name stringtemplate Highest Product jar package name stringtemplate Low Product pom artifactid stringtemplate Highest Product pom developer email jimi@temporal-wave.com Low Product pom developer email parrt@antlr.org Low Product pom developer name Jim Idle Low Product pom developer name Terence Parr Low Product pom developer org Temporal Wave LLC Low Product pom developer org USFCA Low Product pom developer org URL http://www.cs.usfca.edu Low Product pom developer org URL http://www.temporal-wave.com Low Product pom groupid org.antlr Highest Product pom name ANTLR StringTemplate High Product pom url http://www.stringtemplate.org Medium Version file version 3.2.1 High Version pom version 3.2.1 Highest
Description:
univocity's open source parsers for processing different text formats using a consistent API License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/com/univocity/univocity-parsers/2.7.3/univocity-parsers-2.7.3.jar
MD5: f030c01958dc0d7a7dd82c9424b80e66
SHA1: 2d7b2cbe31d203333e0ce2b99ddb9f8afa03fc42
SHA256: fe14476f24434a2e1ad56f1ede561bd0143145dddf8d42e31568e1129c241b77
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name univocity-parsers High Vendor jar package name parsers Highest Vendor jar package name univocity Highest Vendor Manifest bundle-symbolicname com.univocity.parsers Medium Vendor Manifest Implementation-Vendor Univocity Software Pty Ltd High Vendor Manifest Implementation-Vendor-Id com.univocity Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest specification-vendor Univocity Software Pty Ltd Low Vendor pom artifactid univocity-parsers Highest Vendor pom artifactid univocity-parsers Low Vendor pom developer email jbax@univocity.com Low Vendor pom developer email parsers@univocity.com Low Vendor pom developer id jbax Medium Vendor pom developer id parsers Medium Vendor pom developer name Jeronimo Backes Medium Vendor pom developer name univocity parser development team Medium Vendor pom groupid com.univocity Highest Vendor pom name univocity-parsers High Vendor pom organization name Univocity Software Pty Ltd High Vendor pom organization url www.univocity.com Medium Vendor pom url http://github.com/univocity/univocity-parsers Highest Product file name univocity-parsers High Product jar package name parsers Highest Product jar package name univocity Highest Product Manifest Bundle-Name univocity-parsers Medium Product Manifest bundle-symbolicname com.univocity.parsers Medium Product Manifest Implementation-Title univocity-parsers High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest specification-title univocity-parsers Medium Product pom artifactid univocity-parsers Highest Product pom developer email jbax@univocity.com Low Product pom developer email parsers@univocity.com Low Product pom developer id jbax Low Product pom developer id parsers Low Product pom developer name Jeronimo Backes Low Product pom developer name univocity parser development team Low Product pom groupid com.univocity Highest Product pom name univocity-parsers High Product pom organization name Univocity Software Pty Ltd Low Product pom organization url www.univocity.com Low Product pom url http://github.com/univocity/univocity-parsers Medium Version file version 2.7.3 High Version Manifest Bundle-Version 2.7.3 High Version Manifest Implementation-Version 2.7.3 High Version pom version 2.7.3 Highest
License:
The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/spark-project/spark/unused/1.0.0/unused-1.0.0.jar
MD5: 763373ce9fe48581d4f2b8ffca35bb82
SHA1: 205fe37a2fade6ce6dfcf8eff57ed21a4a1c22af
SHA256: 00fd27fc9bde701581e7dcf5b95981d9e749a1c176bb8bfcd49f675768ff6bf0
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-integration-test:compile livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name unused High Vendor jar package name apache Low Vendor jar package name spark Highest Vendor jar package name spark Low Vendor jar package name unused Highest Vendor jar package name unused Low Vendor pom artifactid unused Highest Vendor pom artifactid unused Low Vendor pom developer email pwendell@gmail.com Low Vendor pom developer name Patrick Wendell Medium Vendor pom developer org Databricks Medium Vendor pom developer org URL http://databricks.com Medium Vendor pom groupid org.spark-project.spark Highest Vendor pom name empty High Product file name unused High Product jar package name spark Highest Product jar package name spark Low Product jar package name unused Highest Product jar package name unused Low Product jar package name unusedstubclass Low Product pom artifactid unused Highest Product pom developer email pwendell@gmail.com Low Product pom developer name Patrick Wendell Low Product pom developer org Databricks Low Product pom developer org URL http://databricks.com Low Product pom groupid org.spark-project.spark Highest Product pom name empty High Version file version 1.0.0 High Version pom version 1.0.0 Highest
Related Dependencies Description:
Bean Validation API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar
MD5: 4c257f52462860b62ab3cdab45f53082
SHA1: 8613ae82954779d518631e05daa73a6a954817d5
SHA256: f39d7ba7253e35f5ac48081ec1bc28c5df9b32ac4b7db20853e5a8e76bf7b0ed
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name validation-api High Vendor jar package name javax Highest Vendor jar package name validation Highest Vendor Manifest bundle-symbolicname javax.validation.api Medium Vendor pom artifactid validation-api Highest Vendor pom artifactid validation-api Low Vendor pom developer email emmanuel@hibernate.org Low Vendor pom developer email gunnar@hibernate.org Low Vendor pom developer email hferents@redhat.com Low Vendor pom developer id emmanuelbernard Medium Vendor pom developer id epbernard Medium Vendor pom developer id gunnar.morling Medium Vendor pom developer id hardy.ferentschik Medium Vendor pom developer name Emmanuel Bernard Medium Vendor pom developer name Gunnar Morling Medium Vendor pom developer name Hardy Ferentschik Medium Vendor pom developer org JBoss, by Red Hat Medium Vendor pom groupid javax.validation Highest Vendor pom name Bean Validation API High Vendor pom url http://beanvalidation.org Highest Product file name validation-api High Product jar package name javax Highest Product jar package name validation Highest Product Manifest Bundle-Name Bean Validation API Medium Product Manifest bundle-symbolicname javax.validation.api Medium Product pom artifactid validation-api Highest Product pom developer email emmanuel@hibernate.org Low Product pom developer email gunnar@hibernate.org Low Product pom developer email hferents@redhat.com Low Product pom developer id emmanuelbernard Low Product pom developer id epbernard Low Product pom developer id gunnar.morling Low Product pom developer id hardy.ferentschik Low Product pom developer name Emmanuel Bernard Low Product pom developer name Gunnar Morling Low Product pom developer name Hardy Ferentschik Low Product pom developer org JBoss, by Red Hat Low Product pom groupid javax.validation Highest Product pom name Bean Validation API High Product pom url http://beanvalidation.org Medium Version Manifest Bundle-Version 1.1.0.Final High Version pom version 1.1.0.Final Highest
File Path: /root/.m2/repository/org/apache/xbean/xbean-asm6-shaded/4.8/xbean-asm6-shaded-4.8.jar/META-INF/maven/org.apache.xbean/xbean-asm-util/pom.xmlMD5: c7a9a112732cbde351e5cce475c3595cSHA1: a4dfeabf9e8c7efd0a78a21303bf0297f71531b9SHA256: e5db31ed9ab5a663fde08cad3802b12c0f761c7c3e87931a90ac64b64b1f06f7Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor pom artifactid xbean-asm-util Low Vendor pom groupid org.apache.xbean Highest Vendor pom name Apache XBean :: ASM Util High Vendor pom parent-artifactid xbean Low Product pom artifactid xbean-asm-util Highest Product pom groupid org.apache.xbean Highest Product pom name Apache XBean :: ASM Util High Product pom parent-artifactid xbean Medium Version pom version 4.8 Highest
Description:
Repackaged and shaded asm 6.x jars License:
http://asm.ow2.org/license.html
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/xbean/xbean-asm6-shaded/4.8/xbean-asm6-shaded-4.8.jar
MD5: 274b8443321c484dc67c0ae0ef3458dd
SHA1: 034bd7c7236dfa87de173e4328354ba0701a374c
SHA256: 6fcc2dee8aac3c47d70e90423673c346f3e4f9eb1d14e1df5c218f83cdd60408
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name xbean-asm6-shaded High Vendor jar package name apache Highest Vendor jar package name asm6 Highest Vendor jar package name xbean Highest Vendor Manifest automatic-module-name org.apache.xbean.asm6.shaded Medium Vendor Manifest bundle-docurl http://geronimo.apache.org/maven/xbean/4.8/xbean-asm6-shaded Low Vendor Manifest bundle-symbolicname org.apache.xbean.asm6-shaded Medium Vendor pom artifactid xbean-asm6-shaded Highest Vendor pom artifactid xbean-asm6-shaded Low Vendor pom groupid org.apache.xbean Highest Vendor pom name Apache XBean :: ASM 6 shaded (repackaged) High Vendor pom parent-artifactid xbean Low Product file name xbean-asm6-shaded High Product jar package name apache Highest Product jar package name asm6 Highest Product jar package name xbean Highest Product Manifest automatic-module-name org.apache.xbean.asm6.shaded Medium Product Manifest bundle-docurl http://geronimo.apache.org/maven/xbean/4.8/xbean-asm6-shaded Low Product Manifest Bundle-Name Apache XBean :: ASM 6 shaded (repackaged) Medium Product Manifest bundle-symbolicname org.apache.xbean.asm6-shaded Medium Product Manifest Implementation-Title Apache XBean :: ASM 6 shaded (repackaged) High Product pom artifactid xbean-asm6-shaded Highest Product pom groupid org.apache.xbean Highest Product pom name Apache XBean :: ASM 6 shaded (repackaged) High Product pom parent-artifactid xbean Medium Version file version 4.8 High Version Manifest Implementation-Version 4.8 High Version pom version 4.8 Highest
Description:
Xerces2 is the next generation of high performance, fully compliant XML parsers in the
Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI),
a complete framework for building parser components and configurations that is extremely
modular and easy to program.
File Path: /root/.m2/repository/xerces/xercesImpl/2.9.1/xercesImpl-2.9.1.jarMD5: f807f86d7d9db25edbfc782aca7ca2a9SHA1: 7bc7e49ddfe4fb5f193ed37ecc96c12292c8ceb6SHA256: 6ae540a7c85c814ac64bea48016b3a6f45c95d4765f547fcc0053dc36c94ed5cReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name xercesImpl High Vendor jar package name apache Highest Vendor jar package name parser Highest Vendor jar package name parsers Highest Vendor jar package name version Highest Vendor jar package name xerces Highest Vendor jar package name xml Highest Vendor jar package name xni Highest Vendor manifest: javax/xml/datatype/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/parsers/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/transform/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/validation/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/xpath/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/apache/xerces/impl/Version.class Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/apache/xerces/xni/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/w3c/dom/ Implementation-Vendor World Wide Web Consortium Medium Vendor manifest: org/w3c/dom/ls/ Implementation-Vendor World Wide Web Consortium Medium Vendor manifest: org/xml/sax/ Implementation-Vendor David Megginson Medium Vendor pom artifactid xercesImpl Highest Vendor pom artifactid xercesImpl Low Vendor pom groupid xerces Highest Vendor pom name Xerces2 Java Parser High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://xerces.apache.org/xerces2-j Highest Product file name xercesImpl High Product hint analyzer product xerces-j Highest Product jar package name apache Highest Product jar package name datatype Highest Product jar package name dom Highest Product jar package name impl Highest Product jar package name parser Highest Product jar package name parsers Highest Product jar package name validation Highest Product jar package name version Highest Product jar package name w3c Highest Product jar package name xerces Highest Product jar package name xml Highest Product jar package name xni Highest Product jar package name xpath Highest Product manifest: javax/xml/datatype/ Implementation-Title javax.xml.datatype Medium Product manifest: javax/xml/datatype/ Specification-Title Java API for XML Processing Medium Product manifest: javax/xml/parsers/ Implementation-Title javax.xml.parsers Medium Product manifest: javax/xml/parsers/ Specification-Title Java API for XML Processing Medium Product manifest: javax/xml/transform/ Implementation-Title javax.xml.transform Medium Product manifest: javax/xml/transform/ Specification-Title Java API for XML Processing Medium Product manifest: javax/xml/validation/ Implementation-Title javax.xml.validation Medium Product manifest: javax/xml/validation/ Specification-Title Java API for XML Processing Medium Product manifest: javax/xml/xpath/ Implementation-Title javax.xml.xpath Medium Product manifest: javax/xml/xpath/ Specification-Title Java API for XML Processing Medium Product manifest: org/apache/xerces/impl/Version.class Implementation-Title org.apache.xerces.impl.Version Medium Product manifest: org/apache/xerces/xni/ Implementation-Title org.apache.xerces.xni Medium Product manifest: org/apache/xerces/xni/ Specification-Title Xerces Native Interface Medium Product manifest: org/w3c/dom/ Implementation-Title org.w3c.dom Medium Product manifest: org/w3c/dom/ Specification-Title Document Object Model, Level 3 Core Medium Product manifest: org/w3c/dom/ls/ Implementation-Title org.w3c.dom.ls Medium Product manifest: org/w3c/dom/ls/ Specification-Title Document Object Model, Level 3 Load and Save Medium Product manifest: org/xml/sax/ Implementation-Title org.xml.sax Medium Product manifest: org/xml/sax/ Specification-Title Simple API for XML Medium Product pom artifactid xercesImpl Highest Product pom groupid xerces Highest Product pom name Xerces2 Java Parser High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://xerces.apache.org/xerces2-j Medium Version file version 2.9.1 High Version manifest: org/apache/xerces/impl/Version.class Implementation-Version 2.9.1 Medium Version pom parent-version 2.9.1 Low Version pom version 2.9.1 Highest
CVE-2012-0881 suppress
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. CWE-399 Resource Management Errors
CVSSv2:
Base Score: HIGH (7.8) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions:
CVE-2013-4002 suppress
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names. NVD-CWE-noinfo
CVSSv2:
Base Score: HIGH (7.1) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:C References:
Vulnerable Software & Versions: (show all )
CVE-2022-23437 suppress
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. CWE-91 XML Injection (aka Blind XPath Injection)
CVSSv2:
Base Score: HIGH (7.1) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:C CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-10355 (OSSINDEX)suppress
sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
The software contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. CWE-833 Deadlock
CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:xerces:xercesImpl:2.9.1:*:*:*:*:*:*:* CVE-2018-2799 suppress
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). NVD-CWE-noinfo
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References:
Vulnerable Software & Versions: (show all )
CVE-2009-2625 suppress
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. NVD-CWE-Other
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
Description:
xml-commons provides an Apache-hosted set of DOM, SAX, and
JAXP interfaces for use in other xml-based projects. Our hope is that we
can standardize on both a common version and packaging scheme for these
critical XML standards interfaces to make the lives of both our developers
and users easier. The External Components portion of xml-commons contains
interfaces that are defined by external standards organizations. For DOM,
that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for
JAXP it's Sun. File Path: /root/.m2/repository/xml-apis/xml-apis/1.3.04/xml-apis-1.3.04.jarMD5: 9ae9c29e4497fc35a3eade1e6dd0bbebSHA1: 90b215f48fe42776c8c7f6e3509ec54e84fd65efSHA256: d404aa881eb9c5f7a4fb546e84ea11506cd417a72b5972e88eff17f43f9f8a64Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name xml-apis High Vendor jar package name apache Highest Vendor jar package name dom Highest Vendor jar package name sax Highest Vendor jar package name version Highest Vendor jar package name w3c Highest Vendor jar package name xml Highest Vendor manifest: javax/xml/datatype/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/parsers/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/transform/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/validation/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/xpath/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/apache/xmlcommons/Version Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/w3c/dom/ Implementation-Vendor World Wide Web Consortium Medium Vendor manifest: org/w3c/dom/ls/ Implementation-Vendor World Wide Web Consortium Medium Vendor manifest: org/xml/sax/ Implementation-Vendor David Megginson Medium Vendor pom artifactid xml-apis Highest Vendor pom artifactid xml-apis Low Vendor pom groupid xml-apis Highest Vendor pom name XML Commons External Components XML APIs High Vendor pom parent-artifactid apache Low Vendor pom parent-groupid org.apache Medium Vendor pom url http://xml.apache.org/commons/components/external/ Highest Product file name xml-apis High Product jar package name apache Highest Product jar package name datatype Highest Product jar package name document Highest Product jar package name dom Highest Product jar package name javax Highest Product jar package name ls Highest Product jar package name parsers Highest Product jar package name sax Highest Product jar package name transform Highest Product jar package name validation Highest Product jar package name version Highest Product jar package name w3c Highest Product jar package name xml Highest Product jar package name xmlcommons Highest Product jar package name xpath Highest Product manifest: javax/xml/datatype/ Implementation-Title javax.xml.datatype Medium Product manifest: javax/xml/datatype/ Specification-Title JSR 206 Java API for XML Processing 1.3 Medium Product manifest: javax/xml/parsers/ Implementation-Title javax.xml.parsers Medium Product manifest: javax/xml/parsers/ Specification-Title JSR 206, Java API for XML Processing 1.3 Medium Product manifest: javax/xml/transform/ Implementation-Title javax.xml.transform Medium Product manifest: javax/xml/transform/ Specification-Title JSR 206 Java API for XML Processing 1.3 Medium Product manifest: javax/xml/validation/ Implementation-Title javax.xml.validation Medium Product manifest: javax/xml/validation/ Specification-Title JSR 206 Java API for XML Processing 1.3 Medium Product manifest: javax/xml/xpath/ Implementation-Title javax.xml.xpath Medium Product manifest: javax/xml/xpath/ Specification-Title JSR 206 Java API for XML Processing 1.3 Medium Product manifest: org/apache/xmlcommons/Version Implementation-Title org.apache.xmlcommons.Version Medium Product manifest: org/w3c/dom/ Implementation-Title org.w3c.dom Medium Product manifest: org/w3c/dom/ Specification-Title Document Object Model (DOM) Level 3 Core Medium Product manifest: org/w3c/dom/ls/ Implementation-Title org.w3c.dom.ls Medium Product manifest: org/w3c/dom/ls/ Specification-Title Document Object Model (DOM) Level 3 Load and Save Medium Product manifest: org/xml/sax/ Implementation-Title org.xml.sax Medium Product manifest: org/xml/sax/ Specification-Title Simple API for XML Medium Product pom artifactid xml-apis Highest Product pom groupid xml-apis Highest Product pom name XML Commons External Components XML APIs High Product pom parent-artifactid apache Medium Product pom parent-groupid org.apache Medium Product pom url http://xml.apache.org/commons/components/external/ Medium Version file version 1.3.04 High Version manifest: javax/xml/datatype/ Implementation-Version 1.3.04 Medium Version manifest: javax/xml/parsers/ Implementation-Version 1.3.04 Medium Version manifest: javax/xml/transform/ Implementation-Version 1.3.04 Medium Version manifest: javax/xml/validation/ Implementation-Version 1.3.04 Medium Version manifest: javax/xml/xpath/ Implementation-Version 1.3.04 Medium Version manifest: org/apache/xmlcommons/Version Implementation-Version 1.3.04 Medium Version pom parent-version 1.3.04 Low Version pom version 1.3.04 Highest
CVE-2021-37533 suppress
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. CWE-20 Improper Input Validation
CVSSv3:
Base Score: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions:
Description:
xmlenc Library License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /root/.m2/repository/xmlenc/xmlenc/0.52/xmlenc-0.52.jar
MD5: c962b6bc3c8de46795b0ed94851fa9c7
SHA1: d82554efbe65906d83b3d97bd7509289e9db561a
SHA256: 282ae185fc2ff27da7714af9962897c09cfefafb88072219c4a2f9c73616c026
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name xmlenc High Vendor jar package name library Highest Vendor jar package name xmlenc Highest Vendor manifest: xmlenc Implementation-Vendor Ernst de Haan Medium Vendor pom artifactid xmlenc Highest Vendor pom artifactid xmlenc Low Vendor pom groupid xmlenc Highest Vendor pom name xmlenc Library High Vendor pom url http://xmlenc.sourceforge.net Highest Product file name xmlenc High Product jar package name library Highest Product jar package name xmlenc Highest Product manifest: xmlenc Implementation-Title xmlenc Medium Product manifest: xmlenc Specification-Title xmlenc Medium Product pom artifactid xmlenc Highest Product pom groupid xmlenc Highest Product pom name xmlenc Library High Product pom url http://xmlenc.sourceforge.net Medium Version file version 0.52 High Version manifest: xmlenc Implementation-Version 0.52 Medium Version pom version 0.52 Highest
Description:
XZ data compression License:
Public Domain File Path: /root/.m2/repository/org/tukaani/xz/1.0/xz-1.0.jar
MD5: 8c53d7a772f11a88ee95c6ed0c215e49
SHA1: ecff5cb8b1189514c9d1d8d68eb77ac372e000c9
SHA256: 7eafdc8880da10286c2398fa42e3bf68c3e845c35ae7a6ae67f5cc1fa16c7405
Referenced In Projects/Scopes: livy-integration-test:compile livy-coverage-report:compile livy-assembly:compile Evidence Type Source Name Value Confidence Vendor file name xz High Vendor jar package name tukaani Highest Vendor jar package name xz Highest Vendor Manifest implementation-url http://tukaani.org/xz/java.html Low Vendor pom artifactid xz Highest Vendor pom artifactid xz Low Vendor pom developer email lasse.collin@tukaani.org Low Vendor pom developer name Lasse Collin Medium Vendor pom groupid org.tukaani Highest Vendor pom name XZ for Java High Vendor pom url http://tukaani.org/xz/java.html Highest Product file name xz High Product jar package name tukaani Highest Product jar package name xz Highest Product Manifest Implementation-Title XZ data compression High Product Manifest implementation-url http://tukaani.org/xz/java.html Low Product pom artifactid xz Highest Product pom developer email lasse.collin@tukaani.org Low Product pom developer name Lasse Collin Low Product pom groupid org.tukaani Highest Product pom name XZ for Java High Product pom url http://tukaani.org/xz/java.html Medium Version file version 1.0 High Version Manifest Implementation-Version 1.0 High Version pom version 1.0 Highest
Description:
XZ data compression License:
Public Domain File Path: /root/.m2/repository/org/tukaani/xz/1.5/xz-1.5.jar
MD5: 51050e595b308c4aec8ac314f66e18bc
SHA1: 9c64274b7dbb65288237216e3fae7877fd3f2bee
SHA256: 86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-server:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name xz High Vendor jar package name tukaani Highest Vendor jar package name xz Highest Vendor Manifest bundle-docurl http://tukaani.org/xz/java.html Low Vendor Manifest bundle-symbolicname org.tukaani.xz Medium Vendor Manifest implementation-url http://tukaani.org/xz/java.html Low Vendor pom artifactid xz Highest Vendor pom artifactid xz Low Vendor pom developer email lasse.collin@tukaani.org Low Vendor pom developer name Lasse Collin Medium Vendor pom groupid org.tukaani Highest Vendor pom name XZ for Java High Vendor pom url http://tukaani.org/xz/java.html Highest Product file name xz High Product jar package name tukaani Highest Product jar package name xz Highest Product Manifest bundle-docurl http://tukaani.org/xz/java.html Low Product Manifest Bundle-Name XZ data compression Medium Product Manifest bundle-symbolicname org.tukaani.xz Medium Product Manifest Implementation-Title XZ data compression High Product Manifest implementation-url http://tukaani.org/xz/java.html Low Product pom artifactid xz Highest Product pom developer email lasse.collin@tukaani.org Low Product pom developer name Lasse Collin Low Product pom groupid org.tukaani Highest Product pom name XZ for Java High Product pom url http://tukaani.org/xz/java.html Medium Version file version 1.5 High Version Manifest Bundle-Version 1.5 High Version Manifest Implementation-Version 1.5 High Version pom version 1.5 Highest
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /root/.m2/repository/org/apache/zookeeper/zookeeper/3.4.6/zookeeper-3.4.6.jar
MD5: 7d01d317c717268725896cfb81b18152
SHA1: 01b2502e29da1ebaade2357cd1de35a855fa3755
SHA256: 8a375a1ef98cbc0e1f6e9dfd0d96d914b74d37ad00b4bf81beb77fa8f34d33ae
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-integration-test:compile livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-api:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-coverage-report:compile livy-assembly:compile livy-repl_2.12:provided livy-server:compile livy-repl_2.11:provided livy-examples:compile Evidence Type Source Name Value Confidence Vendor file name zookeeper High Vendor jar package name apache Highest Vendor jar package name zookeeper Highest Vendor Manifest built-at 02/23/2014 17:18 GMT Low Vendor Manifest built-on fpj-Virtual-Machine Low Vendor Manifest bundle-docurl http://hadoop.apache.org/zookeeper Low Vendor Manifest bundle-symbolicname org.apache.hadoop.zookeeper Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom artifactid zookeeper Highest Vendor pom artifactid zookeeper Low Vendor pom groupid org.apache.zookeeper Highest Product file name zookeeper High Product jar package name apache Highest Product jar package name zookeeper Highest Product Manifest built-at 02/23/2014 17:18 GMT Low Product Manifest built-on fpj-Virtual-Machine Low Product Manifest bundle-docurl http://hadoop.apache.org/zookeeper Low Product Manifest Bundle-Name ZooKeeper Bundle Medium Product Manifest bundle-symbolicname org.apache.hadoop.zookeeper Medium Product Manifest Implementation-Title org.apache.zookeeper High Product pom artifactid zookeeper Highest Product pom groupid org.apache.zookeeper Highest Version file version 3.4.6 High Version Manifest Bundle-Version 3.4.6 High Version pom version 3.4.6 Highest
CVE-2016-5017 suppress
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (6.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: HIGH (8.1) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2017-5637 suppress
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later. CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion'), CWE-306 Missing Authentication for Critical Function
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
CVE-2018-8012 suppress
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader. CWE-862 Missing Authorization
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions: (show all )
CVE-2019-0201 suppress
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users. CWE-862 Missing Authorization
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages. License:
BSD 2-Clause License: https://opensource.org/licenses/BSD-2-Clause File Path: /root/.m2/repository/com/github/luben/zstd-jni/1.3.2-2/zstd-jni-1.3.2-2.jar
MD5: 0ad847203d50c89396c18acc5b4dd45c
SHA1: bde2d9e205aa832222a02e59ab155f42efefbf44
SHA256: 4eb1ecb9f1ee2fff1eddecd367b56c9c3c269575de5396dadeed3b67a73f4a3d
Referenced In Projects/Scopes: livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name zstd-jni High Vendor jar package name github Highest Vendor jar package name luben Highest Vendor jar package name zstd Highest Vendor Manifest bundle-symbolicname com.github.luben.zstd-jni Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom artifactid zstd-jni Highest Vendor pom artifactid zstd-jni Low Vendor pom developer email karavelov@gmail.com Low Vendor pom developer id karavelov Medium Vendor pom developer name Luben Karavelov Medium Vendor pom developer org com.github.luben Medium Vendor pom developer org URL https://github.com/luben Medium Vendor pom groupid com.github.luben Highest Vendor pom name zstd-jni High Vendor pom organization name com.github.luben High Vendor pom url luben/zstd-jni Highest Product file name zstd-jni High Product jar package name github Highest Product jar package name luben Highest Product jar package name zstd Highest Product Manifest Bundle-Name zstd-jni Medium Product Manifest bundle-symbolicname com.github.luben.zstd-jni Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid zstd-jni Highest Product pom developer email karavelov@gmail.com Low Product pom developer id karavelov Low Product pom developer name Luben Karavelov Low Product pom developer org com.github.luben Low Product pom developer org URL https://github.com/luben Low Product pom groupid com.github.luben Highest Product pom name zstd-jni High Product pom organization name com.github.luben Low Product pom url luben/zstd-jni High Version pom version 1.3.2-2 Highest
File Path: /root/.m2/repository/com/github/luben/zstd-jni/1.3.2-2/zstd-jni-1.3.2-2.jar/win/amd64/libzstd-jni.dllMD5: 39cb3f79b1384280e2047927ac1b21bcSHA1: ce3d585d6242bd529b2d8914537e9a937e7566a4SHA256: a0e6c4171331f6cfc4f1ffb375c2cd8749cece9e705526df51da7eb54570530dReferenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name libzstd-jni High Product file name libzstd-jni High
File Path: /root/.m2/repository/com/github/luben/zstd-jni/1.3.2-2/zstd-jni-1.3.2-2.jar/win/x86/libzstd-jni.dllMD5: ea65babb99d547c1c979f3b7c348ef4cSHA1: a3f6b5f8236ecb3ac4047749bdd3fd3857a20e6eSHA256: a086c78acce49277005d9b2fc490a018c09272bfd40d3bcba007f077570fbfe6Referenced In Projects/Scopes:
livy-scala-api_2.12:provided livy-scala-api_2.11:provided livy-scala-api-parent:provided livy-repl_2.12:provided livy-rsc:provided livy-repl-parent:provided livy-test-lib:provided livy-repl_2.11:provided livy-examples:compile livy-api:provided Evidence Type Source Name Value Confidence Vendor file name libzstd-jni High Product file name libzstd-jni High