Skip to content
This repository has been archived by the owner on Jan 20, 2024. It is now read-only.

[Snyk] Fix for 26 vulnerabilities #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 26 vulnerabilities #2

wants to merge 1 commit into from

Conversation

svc-ast-gh-snyk5
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • mule-radio-app/pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-174153		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-2812975		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Man-in-the-Middle (MitM)
SNYK-JAVA-LOG4J-1300176		 org.mule:mule-core:
3.4.0 -> 3.6.0
No No Known Exploit
medium severity 651/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.6		 Arbitrary Code Execution
SNYK-JAVA-LOG4J-2316893		 org.mule:mule-core:
3.4.0 -> 3.6.0
No Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 SQL Injection
SNYK-JAVA-LOG4J-2342645		 org.mule:mule-core:
3.4.0 -> 3.6.0
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342646		 org.mule:mule-core:
3.4.0 -> 3.6.0
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342647		 org.mule:mule-core:
3.4.0 -> 3.6.0
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JAVA-LOG4J-3358774		 org.mule:mule-core:
3.4.0 -> 3.6.0
No No Known Exploit
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-572732		 org.mule:mule-core:
3.4.0 -> 3.6.0
No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JAVA-ORGAPACHESANTUARIO-1655558		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 XML signature spoofing
SNYK-JAVA-ORGAPACHESANTUARIO-30029		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESANTUARIO-30030		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESANTUARIO-30031		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGJDOM-1311147		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No Proof of Concept
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Improper Certificate Validation
SNYK-JAVA-ORGOPENSAML-30140		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGOPENSAML-30141		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Information Exposure
SNYK-JAVA-ORGOPENSAML-31267		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Certificate Validation
SNYK-JAVA-ORGOPENSAML-31268		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Output Neutralization for Logs
SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Input Validation
SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
critical severity 919/1000
Why? Mature exploit, Has a fix available, CVSS 9.8		 Remote Code Execution
SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No Mature
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Directory Traversal
SNYK-JAVA-ORGSPRINGFRAMEWORK-31325		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Integer Overflow or Wraparound
SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-2833360		 org.mule.modules:mule-module-cxf:
3.4.0 -> 3.9.0
No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JAVA-TOMCAT-31382		 org.mule.transports:mule-transport-http:
3.4.0 -> 3.6.0
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 XML External Entity (XXE) Injection
🦉 Arbitrary Code Execution
🦉 SQL Injection
🦉 More lessons are available in Snyk Learn

@snyk-bot @svc-ast-gh-snyk1
fix: mule-radio-app/pom.xml to reduce vulnerabilities
95090e1 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-DOM4J-174153
- https://snyk.io/vuln/SNYK-JAVA-DOM4J-2812975
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-1300176
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2316893
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342645
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342646
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342647
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-3358774
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-572732
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-1655558
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-30029
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-30030
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-30031
- https://snyk.io/vuln/SNYK-JAVA-ORGJDOM-1311147
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30140
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30141
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-31267
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-31268
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31325
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-2833360
- https://snyk.io/vuln/SNYK-JAVA-TOMCAT-31382
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
cla:signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@svc-ast-gh-snyk5 @snyk-bot