Giter VIP home page Giter VIP logo

timebase-ce's Introduction

TimeBase CE

FINOS - Incubating

Maven Central

Business Problem

Time-series data is foundational to both buy-side and sell-side financial services firms. The need for time-series data management systems is well understood and is well-served by products provided under commercial licenses. There are also many open-source time-series data systems but their uptake in financial services firms is less extensive, possibly due to insufficient performance and scalability or lack of appropriateness for financial services time-series data. There is constant demand to reduce total cost of operating technology stacks, whilst at the same time implementing changes to serve new opportunities or meet new obligations. Implementing change in a cost-effective manner has led to an increase in the use of cloud and open-source technologies, and less of a “one size fits all” approach.

Proposed Solution

Having been battle-tested in trading firms for over 10 years under a commercial license, TimeBase is now offered under an open-source license as TimeBase Community Edition”. TimeBase Community Edition was designed from inception for managing time-series data found in financial services.

The goal is to provide enterprise grade time-series data management and messaging capability which enables financial services firms to use with other open-source and commercial components to augment existing solutions, create new solutions.

TimeBase can be used, simultaneously, as a traditional time-series database and real-time data messaging/streaming server. Data structures (“streams”) are user-defined. There is a rich API for interacting (ingesting, streaming) with TimeBase, which provide the necessary hooks for data population and data utilization.

FINOS TimeBase CE Resources

Episode Description
Leveraging TimeBase Community Edition event-oriented time-series database to PowerCloud hosted analytical application.
In this session, Matt will talk about TimeBase Community Edition and how the Open Source Community can leverage this technology to build their own analytical models, data visualizations, and unique applications.

Current State

History:

  • 2006 – Timebase 1.0 (historical data analytics, SQL)
  • 2010 – Timebase 2.0 (timeseries data base, live streaming)
  • 2015 – Timebase 5.0 (Very large databases, HDFS)
  • 2018 – IPC/UDP low latency mode (Timebase topics)
  • 2019 – Cloud support (REST/WS, Docker, Kuber)
  • 2021 – Timebase 6.0 Community Edition (open source)

Roadmap

  1. Replace Apache Tomcat
  2. TimeBase Cluster
  3. NIO Support for network layer

Existing Materials

Build

Build the project with Gradle using this build.gradle file.

You will require the Java 11+ to build TimeBase:

Full clean and build of all modules

    $ ./gradlew clean build

Run

Start TimeBase using Docker

docker run --rm -d \
    -p 8011:8011 \
    --name=timebase-server \
    --ulimit nofile=65536:65536 \
    finos/timebase-ce-server:6.1

Usage example

https://kb.timebase.info/community/development/libs

Releases

The following file lists known Timebase CE vulnerabilities:

https://github.com/finos/TimeBase-CE/blob/main/CVE.md

Contributing

  1. Fork it (https://github.com/finos/TimeBase-CE/fork)
  2. Create your feature branch (git checkout -b feature/fooBar)
  3. Read our contribution guidelines and Community Code of Conduct
  4. Commit your changes (git commit -am 'Add some fooBar')
  5. Push to the branch (git push origin feature/fooBar)
  6. Create a new Pull Request

NOTE: Commits and pull requests to FINOS repositories will only be accepted from those contributors with an active, executed Individual Contributor License Agreement (ICLA) with FINOS OR who are covered under an existing and active Corporate Contribution License Agreement (CCLA) executed with FINOS. Commits from individuals not covered under an ICLA or CCLA will be flagged and blocked by the FINOS Clabot tool. Please note that some CCLAs require individuals/employees to be explicitly named on the CCLA. The EasyCLA bot will monitor all pull requests to ensure compliance.

Need an ICLA? Unsure if you are covered under an existing CCLA? Email [email protected]

Development Team

License

Copyright © 2021 EPAM Systems, Inc.

Distributed under the Apache License, Version 2.0.

SPDX-License-Identifier: Apache-2.0

timebase-ce's People

Contributors

alex-karpovich avatar cm-howard avatar maoo avatar romkisel avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

timebase-ce's Issues

TimeBase Contribution Steps into FINOS

Description

This issue describes the items needed to be done to complete the Timebase contribution into FINOS.

CVE-2021-24122 (Medium) detected in tomcat-embed-core-8.0.53.jar

CVE-2021-24122 - Medium Severity Vulnerability

Vulnerable Library - tomcat-embed-core-8.0.53.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: TimeBase/java/quantserver/web/build.gradle

Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.0.53/9bfd668c63434597ac1d561c9434c166d93fff21/tomcat-embed-core-8.0.53.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.0.53/9bfd668c63434597ac1d561c9434c166d93fff21/tomcat-embed-core-8.0.53.jar

Dependency Hierarchy:

  • tomcat-embed-core-8.0.53.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Publish Date: 2021-01-14

URL: CVE-2021-24122

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24122

Release Date: 2021-01-14

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.107,8.5.60,9.0.40,10.0.0-M10;org.apache.tomcat:tomcat-catalina:7.0.107,8.5.60,9.0.40,10.0.0-M10

CVE-2015-6748 (Medium) detected in jsoup-1.7.2.jar - autoclosed

CVE-2015-6748 - Medium Severity Vulnerability

Vulnerable Library - jsoup-1.7.2.jar

jsoup HTML parser

Library home page: http://jsoup.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jsoup/jsoup/1.7.2/d7e275ba05aa380ca254f72d0c0ffebaedc3adcf/jsoup-1.7.2.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • grib-4.5.5.jar
        • jsoup-1.7.2.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

Publish Date: 2017-09-25

URL: CVE-2015-6748

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6748

Release Date: 2017-09-25

Fix Resolution: 1.8.3

CVE-2016-1000345 (Medium) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000345 - Medium Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

Publish Date: 2018-06-04

URL: CVE-2016-1000345

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2014-0193 (Medium) detected in netty-3.7.0.Final.jar - autoclosed

CVE-2014-0193 - Medium Severity Vulnerability

Vulnerable Library - netty-3.7.0.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: TimeBase/java/timebase/parquet/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.netty/netty/3.7.0.Final/7a8c35599c68c0bf383df74469aa3e03d9aca87/netty-3.7.0.Final.jar

Dependency Hierarchy:

  • hadoop-common-2.9.2.jar (Root Library)
    • hadoop-auth-2.9.2.jar
      • zookeeper-3.4.6.jar
        • netty-3.7.0.Final.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

Publish Date: 2014-05-06

URL: CVE-2014-0193

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0193

Release Date: 2014-05-06

Fix Resolution: io.netty:netty-all:4.0.19.Final,io.netty:netty-codec-http:4.0.19.Final,io.netty:netty:3.6.9.Final,io.netty:netty:3.7.1.Final,io.netty:netty:3.8.2.Final,io.netty:netty:3.9.1.Final

CVE-2016-1000341 (Medium) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000341 - Medium Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Publish Date: 2018-06-04

URL: CVE-2016-1000341

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2019-10172 (High) detected in jackson-mapper-asl-1.9.13.jar - autoclosed

CVE-2019-10172 - High Severity Vulnerability

Vulnerable Library - jackson-mapper-asl-1.9.13.jar

Data Mapper package is a high-performance data binding package built on Jackson JSON processor

Path to dependency file: TimeBase/java/timebase/parquet/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.codehaus.jackson/jackson-mapper-asl/1.9.13/1ee2f2bed0e5dd29d1cb155a166e6f8d50bbddb7/jackson-mapper-asl-1.9.13.jar

Dependency Hierarchy:

  • hadoop-common-2.10.1.jar (Root Library)
    • jersey-json-1.9.jar
      • jackson-jaxrs-1.8.3.jar
        • jackson-mapper-asl-1.9.13.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Publish Date: 2019-11-18

URL: CVE-2019-10172

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10172

Release Date: 2020-02-10

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.0.0-RC1

CVE-2018-14040 (Medium) detected in bootstrap-3.3.7.min.js - autoclosed

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Path to vulnerable library: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Dependency Hierarchy:

  • bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0

CVE-2017-1000487 (High) detected in plexus-utils-1.5.6.jar - autoclosed

CVE-2017-1000487 - High Severity Vulnerability

Vulnerable Library - plexus-utils-1.5.6.jar

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.codehaus.plexus/plexus-utils/1.5.6/8fb6b798a4036048b3005e058553bf21a87802ed/plexus-utils-1.5.6.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • junrar-0.7.jar
        • commons-vfs2-2.0.jar
          • maven-scm-provider-svnexe-1.4.jar
            • plexus-utils-1.5.6.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Publish Date: 2018-01-03

URL: CVE-2017-1000487

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-1000487

Release Date: 2018-01-03

Fix Resolution: 3.0.16

CVE-2014-0114 (Medium) detected in commons-beanutils-1.7.0.jar, commons-beanutils-core-1.8.0.jar - autoclosed

CVE-2014-0114 - Medium Severity Vulnerability

Vulnerable Libraries - commons-beanutils-1.7.0.jar, commons-beanutils-core-1.8.0.jar

commons-beanutils-1.7.0.jar

Path to dependency file: TimeBase/java/timebase/parquet/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.7.0/5675fd96b29656504b86029551973d60fb41339b/commons-beanutils-1.7.0.jar

Dependency Hierarchy:

  • hadoop-common-2.9.1.jar (Root Library)
    • commons-configuration-1.6.jar
      • commons-digester-1.8.jar
        • commons-beanutils-1.7.0.jar (Vulnerable Library)
commons-beanutils-core-1.8.0.jar

The Apache Software Foundation provides support for the Apache community of open-source software projects. The Apache projects are characterized by a collaborative, consensus based development process, an open and pragmatic software license, and a desire to create high quality software that leads the way in its field. We consider ourselves not simply a group of projects sharing a server, but rather a community of developers and users.

Path to dependency file: TimeBase/java/timebase/parquet/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils-core/1.8.0/175dc721f87e4bc5cc0573f990e28c3cf9117508/commons-beanutils-core-1.8.0.jar

Dependency Hierarchy:

  • hadoop-common-2.9.1.jar (Root Library)
    • commons-configuration-1.6.jar
      • commons-beanutils-core-1.8.0.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Publish Date: 2014-04-30

URL: CVE-2014-0114

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114

Release Date: 2014-04-30

Fix Resolution: commons-beanutils:commons-beanutils:1.9.4;org.apache.struts:struts2-core:2.0.5

CVE-2020-11979 (High) detected in ant-1.9.9.jar

CVE-2020-11979 - High Severity Vulnerability

Vulnerable Library - ant-1.9.9.jar

master POM

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.ant/ant/1.9.9/9dc55233d8c0809e57b2ec7f78376da3f32872bd/ant-1.9.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • izpack-panel-5.1.3.jar
      • izpack-util-5.1.3.jar
        • ant-1.9.9.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Publish Date: 2020-10-01

URL: CVE-2020-11979

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://ant.apache.org/security.html

Release Date: 2020-07-21

Fix Resolution: org.apache.ant:ant:1.10.9

CVE-2020-26939 (Medium) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2020-26939 - Medium Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

Publish Date: 2020-11-02

URL: CVE-2020-26939

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/bcgit/bc-java/wiki/CVE-2020-26939

Release Date: 2020-10-11

Fix Resolution: org.bouncycastle:bcprov-jdk14:1.61,org.bouncycastle:bcprov-ext-debug-jdk15on:1.61,org.bouncycastle:bcprov-debug-jdk15on:1.61,org.bouncycastle:bcprov-ext-jdk15on:1.61,org.bouncycastle:bcprov-jdk15on:1.61

CVE-2019-10202 (High) detected in jackson-databind-2.9.6.jar - autoclosed

CVE-2019-10202 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Publish Date: 2019-10-01

URL: CVE-2019-10202

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://access.redhat.com/errata/RHSA-2019:2938

Release Date: 2019-10-01

Fix Resolution: JBoss Enterprise Application Platform - 7.2.4;com.fasterxml.jackson.core:jackson-databind:2.9.9

CVE-2018-1338 (Medium) detected in tika-parsers-1.9.jar - autoclosed

CVE-2018-1338 - Medium Severity Vulnerability

Vulnerable Library - tika-parsers-1.9.jar

Apache Tika is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.9/9247e475d6346eaec183a41cd271264f4abde66e/tika-parsers-1.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Publish Date: 2018-04-25

URL: CVE-2018-1338

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1338

Release Date: 2018-04-25

Fix Resolution: org.apache.tika:tika-bundle:1.18,org.apache.tika:tika-parsers:1.18

CVE-2019-17359 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2019-17359 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Publish Date: 2019-10-08

URL: CVE-2019-17359

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17359

Release Date: 2019-10-08

Fix Resolution: org.bouncycastle:bcprov-jdk15on:1.64

CVE-2018-20677 (Medium) detected in bootstrap-3.3.7.min.js - autoclosed

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Path to vulnerable library: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Dependency Hierarchy:

  • bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

CVE-2015-0250 (Medium) detected in batik-dom-3.2.0.3958.jar

CVE-2015-0250 - Medium Severity Vulnerability

Vulnerable Library - batik-dom-3.2.0.3958.jar

Batik DOM

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/batik/batik-dom/1.6/27983405f0871f28d3b9ab35b44e62610a60564a/batik-dom-1.6.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • izpack-panel-5.1.3.jar
      • icepdf-viewer-6.2.2.jar
        • batik-dom-1.6.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Publish Date: 2015-03-24

URL: CVE-2015-0250

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0250

Release Date: 2015-03-24

Fix Resolution: 1.8

CVE-2018-14042 (Medium) detected in bootstrap-3.3.7.min.js - autoclosed

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Path to vulnerable library: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Dependency Hierarchy:

  • bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

CVE-2018-1339 (Medium) detected in tika-parsers-1.9.jar - autoclosed

CVE-2018-1339 - Medium Severity Vulnerability

Vulnerable Library - tika-parsers-1.9.jar

Apache Tika is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.9/9247e475d6346eaec183a41cd271264f4abde66e/tika-parsers-1.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

Publish Date: 2018-04-25

URL: CVE-2018-1339

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1339

Release Date: 2018-04-25

Fix Resolution: org.apache.tika:tika-bundle:1.18,org.apache.tika:tika-parsers:1.18,org.apache.tika:tika-bundle:1.18,org.apache.tika:tika-app:1.18

CVE-2018-8036 (Medium) detected in fontbox-1.8.10.jar - autoclosed

CVE-2018-8036 - Medium Severity Vulnerability

Vulnerable Library - fontbox-1.8.10.jar

The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox.

Library home page: http://pdfbox.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.pdfbox/fontbox/1.8.10/41776c7713e3f3a1ce688bd96459fc597298c340/fontbox-1.8.10.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • izpack-panel-5.1.3.jar
      • pdfbox-1.8.10.jar
        • fontbox-1.8.10.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Publish Date: 2018-07-03

URL: CVE-2018-8036

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8036

Release Date: 2018-07-03

Fix Resolution: org.apache.pdfbox:fontbox:2.0.11,1.8.15,org.apache.pdfbox:debugger-app:2.0.11

CVE-2018-1000180 (High) detected in bcprov-ext-jdk15on-1.54.jar - autoclosed

CVE-2018-1000180 - High Severity Vulnerability

Vulnerable Library - bcprov-ext-jdk15on-1.54.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8. Note: this package includes the NTRU encryption algorithms.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-ext-jdk15on/1.54/8abae535dafbc48b379071efa7372bce1aa9782/bcprov-ext-jdk15on-1.54.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • izpack-panel-5.1.3.jar
      • icepdf-viewer-6.2.2.jar
        • bcprov-ext-jdk15on-1.54.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Publish Date: 2018-06-05

URL: CVE-2018-1000180

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000180

Release Date: 2018-06-05

Fix Resolution: org.bouncycastle:bcprov-jdk15on:1.60,org.bouncycastle:bcprov-jdk14:1.60,org.bouncycastle:bcprov-ext-jdk14:1.60,org.bouncycastle:bcprov-ext-jdk15on:1.60

CVE-2014-3577 (Medium) detected in httpclient-4.2.6.jar - autoclosed

CVE-2014-3577 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.2.6.jar

HttpComponents Client

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.2.6/e4ca30a6a3a075053a61c6fc850d2432dc012ba7/httpclient-4.2.6.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • netcdf4-4.5.5.jar
        • cdm-4.5.5.jar
          • httpservices-4.5.5.jar
            • httpclient-4.2.6.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Publish Date: 2014-08-21

URL: CVE-2014-3577

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/apache/struts/tree/STRUTS_4_3_5/

Release Date: 2014-08-21

Fix Resolution: org.apache.httpcomponents:httpasyncclient:4.0.2, org.apache.httpcomponents:httpclient:4.3.5

CVE-2016-1000340 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000340 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

Publish Date: 2018-06-04

URL: CVE-2016-1000340

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2020-9488 (Low) detected in log4j-1.2.17.jar - autoclosed

CVE-2020-9488 - Low Severity Vulnerability

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: TimeBase/java/timebase/mibc/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.17/5af35056b4d257e4b64b9e8069c0746e8b08629f/log4j-1.2.17.jar

Dependency Hierarchy:

  • snmpagent-1.0 (Root Library)
    • snmp4j-2.5.8.jar
      • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Publish Date: 2020-04-27

URL: CVE-2020-9488

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/LOG4J2-2819

Release Date: 2020-04-27

Fix Resolution: org.apache.logging.log4j:log4j-core:2.13.2

CVE-2015-6644 (Low) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2015-6644 - Low Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.

Publish Date: 2016-01-06

URL: CVE-2015-6644

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://www.securitytracker.com/id/1034592

Fix Resolution: The vendor has issued a fix (Build LMY49F, 6.0 with Security Patch Level of January 1, 2016).

The vendor's advisory is available at:

http://source.android.com/security/bulletin/2016-01-01.html

CVE-2019-0201 (Medium) detected in zookeeper-3.4.10.jar - autoclosed

CVE-2019-0201 - Medium Severity Vulnerability

Vulnerable Library - zookeeper-3.4.10.jar

Path to dependency file: TimeBase/java/timebase/parquet/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.zookeeper/zookeeper/3.4.10/8eebdbb7a9df83e02eaa42d0e5da0b57bf2e4da/zookeeper-3.4.10.jar

Dependency Hierarchy:

  • hadoop-common-2.10.1.jar (Root Library)
    • zookeeper-3.4.10.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Publish Date: 2019-05-23

URL: CVE-2019-0201

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://zookeeper.apache.org/security.html

Release Date: 2019-05-23

Fix Resolution: 3.4.14, 3.5.5

WS-2019-0379 (Medium) detected in commons-codec-1.11.jar - autoclosed

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.11.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.11/3acb4705652e16236558f0f4f2192cc33c3bd189/commons-codec-1.11.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • netcdf4-4.5.5.jar
        • cdm-4.5.5.jar
          • httpservices-4.5.5.jar
            • httpclient-4.5.6.jar
              • commons-codec-1.11.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

CVE-2016-1000343 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000343 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

Publish Date: 2018-06-04

URL: CVE-2016-1000343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2016-4216 (High) detected in xmpcore-5.1.2.jar - autoclosed

CVE-2016-4216 - High Severity Vulnerability

Vulnerable Library - xmpcore-5.1.2.jar

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Library home page: http://www.adobe.com/devnet/xmp.html

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.adobe.xmp/xmpcore/5.1.2/55615fa2582424e38705487d1d3969af8554f637/xmpcore-5.1.2.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • metadata-extractor-2.8.0.jar
        • xmpcore-5.1.2.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Publish Date: 2016-07-13

URL: CVE-2016-4216

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4216

Release Date: 2016-07-13

Fix Resolution: 5.1.3

CVE-2016-1000342 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000342 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Publish Date: 2018-06-04

URL: CVE-2016-1000342

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342

Release Date: 2018-06-04

Fix Resolution: 1.56

CVE-2018-20433 (High) detected in c3p0-0.9.1.1.jar - autoclosed

CVE-2018-20433 - High Severity Vulnerability

Vulnerable Library - c3p0-0.9.1.1.jar

c3p0 is an easy-to-use library for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension.

Library home page: http://c3p0.sourceforge.net

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/c3p0/c3p0/0.9.1.1/302704f30c6e7abb7a0457f7771739e03c973e80/c3p0-0.9.1.1.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • netcdf4-4.5.5.jar
        • cdm-4.5.5.jar
          • quartz-2.2.0.jar
            • c3p0-0.9.1.1.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

Publish Date: 2018-12-24

URL: CVE-2018-20433

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20433

Release Date: 2018-12-24

Fix Resolution: 0.9.5.3

CVE-2017-12974 (High) detected in nimbus-jose-jwt-3.1.2.jar - autoclosed

CVE-2017-12974 - High Severity Vulnerability

Vulnerable Library - nimbus-jose-jwt-3.1.2.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/3.1.2/105c0ca7e1dc2c0bfaa1b8c65d7bc45231935e19/nimbus-jose-jwt-3.1.2.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Publish Date: 2017-08-20

URL: CVE-2017-12974

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12974

Release Date: 2017-08-20

Fix Resolution: 4.36

CVE-2019-12415 (Medium) detected in poi-ooxml-4.0.0.jar - autoclosed

CVE-2019-12415 - Medium Severity Vulnerability

Vulnerable Library - poi-ooxml-4.0.0.jar

Apache POI - Java API To Access Microsoft Format Files

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.poi/poi-ooxml/4.0.0/f3fa9c2bd64eb3ec15378de960a07d077ae5b26d/poi-ooxml-4.0.0.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • poi-ooxml-4.0.0.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Publish Date: 2019-10-23

URL: CVE-2019-12415

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415

Release Date: 2019-10-23

Fix Resolution: 4.1.1

CVE-2016-1000346 (Low) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000346 - Low Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

Publish Date: 2018-06-04

URL: CVE-2016-1000346

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000346

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2017-12972 (High) detected in nimbus-jose-jwt-3.1.2.jar - autoclosed

CVE-2017-12972 - High Severity Vulnerability

Vulnerable Library - nimbus-jose-jwt-3.1.2.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/3.1.2/105c0ca7e1dc2c0bfaa1b8c65d7bc45231935e19/nimbus-jose-jwt-3.1.2.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

Publish Date: 2017-08-20

URL: CVE-2017-12972

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12972

Release Date: 2017-08-20

Fix Resolution: 4.39

FINOS Review - Contribution Compliance Requirements for FINOS Contribution

Description

Following a quick review of the TimeBase project prior to FINOS contribution, this issue describes prerequisites needed within the open source project as outlined in the Contribution Compliance Requirements document below ...

Please Note : The relevant information should also be included in the dependencies consumed by TimeBase as hosted in the EPAM (or other) GitHub Organisation - https://github.com/epam?q=timebase&type=&language=&sort=

Project Information

License Information

Third-Party Code Compliance

cc @stuartfarr, @avavilau, @alex-karpovich, @cm-howard

CVE-2018-11797 (Medium) detected in pdfbox-2.0.11.jar - autoclosed

CVE-2018-11797 - Medium Severity Vulnerability

Vulnerable Library - pdfbox-2.0.11.jar

The Apache PDFBox library is an open source Java tool for working with PDF documents.

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.pdfbox/pdfbox/2.0.11/eb7e033d9ae41bd4f0b83681bc5dc01c2488d250/pdfbox-2.0.11.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • pdfbox-2.0.11.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Publish Date: 2018-10-05

URL: CVE-2018-11797

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11797

Release Date: 2018-10-05

Fix Resolution: 2.0.12,1.8.16

CVE-2018-1335 (High) detected in tika-core-1.9.jar, tika-parsers-1.9.jar - autoclosed

CVE-2018-1335 - High Severity Vulnerability

Vulnerable Libraries - tika-core-1.9.jar, tika-parsers-1.9.jar

tika-core-1.9.jar

This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-core/1.9/b7fab4031550cfa0a6fb0a23bbbae92c33982d4a/tika-core-1.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • vorbis-java-tika-0.6.jar
        • tika-core-1.9.jar (Vulnerable Library)
tika-parsers-1.9.jar

Apache Tika is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.9/9247e475d6346eaec183a41cd271264f4abde66e/tika-parsers-1.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

Publish Date: 2018-04-25

URL: CVE-2018-1335

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1335

Release Date: 2018-04-25

Fix Resolution: org.apache.tika:tika-server:1.18

CVE-2021-23926 (High) detected in xmlbeans-2.6.0.jar - autoclosed

CVE-2021-23926 - High Severity Vulnerability

Vulnerable Library - xmlbeans-2.6.0.jar

XmlBeans main jar

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.xmlbeans/xmlbeans/2.6.0/29e80d2dd51f9dcdef8f9ffaee0d4dc1c9bbfc87/xmlbeans-2.6.0.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • poi-ooxml-3.12.jar
        • poi-ooxml-schemas-3.12.jar
          • xmlbeans-2.6.0.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Publish Date: 2021-01-14

URL: CVE-2021-23926

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23926

Release Date: 2021-01-14

Fix Resolution: org.apache.xmlbeans:xmlbeans:3.0.0

CVE-2016-1000352 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000352 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000352

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2016-5388 (High) detected in tomcat-embed-core-8.0.53.jar

CVE-2016-5388 - High Severity Vulnerability

Vulnerable Library - tomcat-embed-core-8.0.53.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: TimeBase/java/quantserver/web/build.gradle

Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.0.53/9bfd668c63434597ac1d561c9434c166d93fff21/tomcat-embed-core-8.0.53.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/8.0.53/9bfd668c63434597ac1d561c9434c166d93fff21/tomcat-embed-core-8.0.53.jar

Dependency Hierarchy:

  • tomcat-embed-core-8.0.53.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

Publish Date: 2016-07-19

URL: CVE-2016-5388

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5388

Release Date: 2016-07-19

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:8.5.5,7.0.72,org.apache.tomcat:tomcat-catalina:8.5.5,7.0.72


  • Check this box to open an automated fix PR

CVE-2020-15250 (Medium) detected in junit-4.10.jar - autoclosed

CVE-2020-15250 - Medium Severity Vulnerability

Vulnerable Library - junit-4.10.jar

JUnit is a regression testing framework written by Erich Gamma and Kent Beck. It is used by the developer who implements unit tests in Java.

Library home page: http://junit.org

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/junit/junit/4.10/e4f1766ce7404a08f45d859fb9c226fc9e41a861/junit-4.10.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar
      • json-simple-1.1.1.jar
        • junit-4.10.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Publish Date: 2020-10-12

URL: CVE-2020-15250

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-269g-pwp5-87pp

Release Date: 2020-07-21

Fix Resolution: junit:junit:4.13.1

CVE-2018-20676 (Medium) detected in bootstrap-3.3.7.min.js - autoclosed

CVE-2018-20676 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Path to vulnerable library: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Dependency Hierarchy:

  • bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

CVE-2016-4434 (High) detected in tika-parsers-1.9.jar - autoclosed

CVE-2016-4434 - High Severity Vulnerability

Vulnerable Library - tika-parsers-1.9.jar

Apache Tika is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.9/9247e475d6346eaec183a41cd271264f4abde66e/tika-parsers-1.9.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.9.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.

Publish Date: 2017-09-30

URL: CVE-2016-4434

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-4434

Release Date: 2017-09-30

Fix Resolution: 1.13-rc1

WS-2019-0490 (High) detected in jcommander-1.35.jar - autoclosed

WS-2019-0490 - High Severity Vulnerability

Vulnerable Library - jcommander-1.35.jar

A Java framework to parse command line options with annotations.

Library home page: http://beust.com/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.beust/jcommander/1.35/47592e181b0bdbbeb63029e08c5e74f6803c4edd/jcommander-1.35.jar

Dependency Hierarchy:

  • izpack-compiler-5.1.3.jar (Root Library)
    • tika-parsers-1.19.jar
      • netcdf4-4.5.5.jar
        • cdm-4.5.5.jar
          • jcommander-1.35.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Publish Date: 2019-02-19

URL: WS-2019-0490

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cbeust/jcommander#465

Release Date: 2019-02-19

Fix Resolution: com.beust:jcommander:1.75

CVE-2020-9489 (Medium) detected in tika-parsers-1.19.jar - autoclosed

CVE-2020-9489 - Medium Severity Vulnerability

Vulnerable Library - tika-parsers-1.19.jar

Apache Tika is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries.

Library home page: http://tika.apache.org/

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.19/e22c132123acede8d6985584e679e62a50d3590d/tika-parsers-1.19.jar,canner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-parsers/1.19/e22c132123acede8d6985584e679e62a50d3590d/tika-parsers-1.19.jar

Dependency Hierarchy:

  • tika-parsers-1.19.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Publish Date: 2020-04-27

URL: CVE-2020-9489

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9489

Release Date: 2020-04-27

Fix Resolution: org.apache.tika:tika-parsers:1.24.1


  • Check this box to open an automated fix PR

CVE-2019-8331 (Medium) detected in bootstrap-3.3.7.min.js - autoclosed

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Path to vulnerable library: TimeBase/java/timebase/web/src/main/webapp/WEB-INF/jsp/common/header.jsp

Dependency Hierarchy:

  • bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#28236

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

CVE-2016-1000344 (High) detected in bcprov-jdk15on-1.51.jar - autoclosed

CVE-2016-1000344 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.51.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.51/9ab8afcc2842d5ef06eb775a0a2b12783b99aa80/bcprov-jdk15on-1.51.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar
          • bcprov-jdk15on-1.51.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000344

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk15on:1.56,org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

CVE-2017-12973 (Low) detected in nimbus-jose-jwt-3.1.2.jar - autoclosed

CVE-2017-12973 - Low Severity Vulnerability

Vulnerable Library - nimbus-jose-jwt-3.1.2.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: TimeBase/java/timebase/server/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/3.1.2/105c0ca7e1dc2c0bfaa1b8c65d7bc45231935e19/nimbus-jose-jwt-3.1.2.jar

Dependency Hierarchy:

  • azure-client-authentication-1.0.0-beta2.jar (Root Library)
    • adal4j-1.1.2.jar
      • oauth2-oidc-sdk-4.5.jar
        • nimbus-jose-jwt-3.1.2.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Publish Date: 2017-08-20

URL: CVE-2017-12973

CVSS 3 Score Details (3.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12973

Release Date: 2017-08-20

Fix Resolution: 4.39

CVE-2018-11796 (High) detected in tika-core-1.19.jar - autoclosed

CVE-2018-11796 - High Severity Vulnerability

Vulnerable Library - tika-core-1.19.jar

This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.

Path to dependency file: TimeBase/java/installer/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-core/1.19/d2f2c3b7a69279b6d078e5f1f3c4849fc2cd87f3/tika-core-1.19.jar,canner/.gradle/caches/modules-2/files-2.1/org.apache.tika/tika-core/1.19/d2f2c3b7a69279b6d078e5f1f3c4849fc2cd87f3/tika-core-1.19.jar

Dependency Hierarchy:

  • tika-core-1.19.jar (Vulnerable Library)

Found in HEAD commit: 98f6880b361c00a247f77e79a787646e9664cadd

Found in base branch: main

Vulnerability Details

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.

Publish Date: 2018-10-09

URL: CVE-2018-11796

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8017

Release Date: 2018-10-09

Fix Resolution: 1.19.1


  • Check this box to open an automated fix PR

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.