forked from amaybaum-local/vprofile-project2
-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) unreachable #15
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-local-app
bot
added
the
Mend: dependency security vulnerability
Security vulnerability detected by Mend
label
Feb 14, 2024
1 task
mend-local-app
bot
changed the title
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) unreachable
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) non-reachable
Feb 14, 2024
mend-local-app
bot
changed the title
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) non-reachable
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) unreachable
Feb 15, 2024
mend-local-app
bot
changed the title
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) unreachable
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6)
Mar 12, 2024
mend-local-app
bot
changed the title
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6)
spring-data-jpa-1.8.1.RELEASE.jar: 1 vulnerabilities (highest severity is: 5.6) unreachable
Mar 12, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
0 participants
Vulnerable Library - spring-data-jpa-1.8.1.RELEASE.jar
Spring Data module for JPA repositories.
Library home page: http://projects.spring.io/spring-data-jpa
Path to dependency file: /pom.xml
Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/springframework/data/spring-data-jpa/1.8.1.RELEASE/spring-data-jpa-1.8.1.RELEASE.jar
Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07
Vulnerabilities
Unreachable
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2016-6652
Vulnerable Library - spring-data-jpa-1.8.1.RELEASE.jar
Spring Data module for JPA repositories.
Library home page: http://projects.spring.io/spring-data-jpa
Path to dependency file: /pom.xml
Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/springframework/data/spring-data-jpa/1.8.1.RELEASE/spring-data-jpa-1.8.1.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07
Found in base branch: vp-rem
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
Publish Date: 2016-10-05
URL: CVE-2016-6652
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6652
Release Date: 2016-10-05
Fix Resolution: 1.9.6,1.10.4
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: