transport-5.6.4.jar: 7 vulnerabilities (highest severity is: 9.8) reachable

[mend-local-app]

Vulnerable Library - transport-5.6.4.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (transport version)	Remediation Possible**	Reachability
CVE-2020-11612	High	9.8	netty-codec-4.1.13.Final.jar	Transitive	N/A*	❌	Reachable
CVE-2019-20445	High	9.1	netty-codec-http-4.1.13.Final.jar	Transitive	N/A*	❌	Reachable
CVE-2019-20444	High	9.1	netty-codec-http-4.1.13.Final.jar	Transitive	N/A*	❌	Reachable
CVE-2020-7238	High	7.5	netty-codec-http-4.1.13.Final.jar	Transitive	N/A*	❌	Reachable
CVE-2019-16869	High	7.5	netty-codec-http-4.1.13.Final.jar	Transitive	N/A*	❌	Reachable
WS-2019-0379	Medium	6.5	commons-codec-1.10.jar	Transitive	N/A*	❌	Reachable
WS-2017-3734	Medium	5.5	httpclient-4.5.2.jar	Transitive	N/A*	❌	Reachable

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-11612

Vulnerable Library - netty-codec-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec/4.1.13.Final/netty-codec-4.1.13.Final.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • transport-netty4-client-5.6.4.jar
    • ❌ netty-codec-4.1.13.Final.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.transport.Netty4Plugin (Extension)
    -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension)
    ...
      -> io.netty.handler.codec.http.HttpContentCompressor (Extension)
       -> io.netty.handler.codec.compression.ZlibCodecFactory (Extension)
        -> ❌ io.netty.handler.codec.compression.JZlibDecoder (Vulnerable Component)

Vulnerability Details

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Publish Date: 2020-04-07

URL: CVE-2020-11612

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://netty.io/news/2020/02/28/4-1-46-Final.html

Release Date: 2020-04-07

Fix Resolution: io.netty:netty-codec:4.1.46.Final;io.netty:netty-all:4.1.46.Final

CVE-2019-20445

Vulnerable Library - netty-codec-http-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • transport-netty4-client-5.6.4.jar
    • ❌ netty-codec-http-4.1.13.Final.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.transport.Netty4Plugin (Extension)
    -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension)
     -> org.elasticsearch.http.netty4.Netty4HttpServerTransport$HttpChannelHandler (Extension)
      -> io.netty.handler.codec.http.HttpObjectAggregator (Extension)
       -> ❌ io.netty.handler.codec.http.HttpObjectDecoder (Vulnerable Component)

Vulnerability Details

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Publish Date: 2020-01-29

URL: CVE-2019-20445

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20445

Release Date: 2020-01-29

Fix Resolution: io.netty:netty-codec-http:4.1.44

CVE-2019-20444

Vulnerable Library - netty-codec-http-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • transport-netty4-client-5.6.4.jar
    • ❌ netty-codec-http-4.1.13.Final.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.transport.Netty4Plugin (Extension)
    -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension)
     -> org.elasticsearch.http.netty4.Netty4HttpServerTransport$HttpChannelHandler (Extension)
      -> io.netty.handler.codec.http.HttpObjectAggregator (Extension)
       -> ❌ io.netty.handler.codec.http.HttpObjectDecoder (Vulnerable Component)

Vulnerability Details

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Publish Date: 2020-01-29

URL: CVE-2019-20444

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444

Release Date: 2020-01-29

Fix Resolution: io.netty:netty-codec-http:4.1.44

CVE-2020-7238

Vulnerable Library - netty-codec-http-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • transport-netty4-client-5.6.4.jar
    • ❌ netty-codec-http-4.1.13.Final.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.transport.Netty4Plugin (Extension)
    -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension)
     -> org.elasticsearch.http.netty4.Netty4HttpServerTransport$HttpChannelHandler (Extension)
      -> io.netty.handler.codec.http.HttpObjectAggregator (Extension)
       -> ❌ io.netty.handler.codec.http.HttpObjectDecoder (Vulnerable Component)

Vulnerability Details

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Publish Date: 2020-01-27

URL: CVE-2020-7238

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-27

Fix Resolution: io.netty:netty-all:4.1.44.Final;io.netty:netty-codec-http:4.1.44.Final

CVE-2019-16869

Vulnerable Library - netty-codec-http-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • transport-netty4-client-5.6.4.jar
    • ❌ netty-codec-http-4.1.13.Final.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.transport.Netty4Plugin (Extension)
    -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension)
     -> org.elasticsearch.http.netty4.Netty4HttpServerTransport$HttpChannelHandler (Extension)
      -> io.netty.handler.codec.http.HttpObjectAggregator (Extension)
       -> ❌ io.netty.handler.codec.http.HttpObjectDecoder (Vulnerable Component)

Vulnerability Details

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Publish Date: 2019-09-26

URL: CVE-2019-16869

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16869

Release Date: 2019-09-26

Fix Resolution: io.netty:netty-all:4.1.42.Final,io.netty:netty-codec-htt:4.1.42.Final

WS-2019-0379

Vulnerable Library - commons-codec-1.10.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • reindex-client-5.6.4.jar
    • elasticsearch-rest-client-5.6.4.jar
      • ❌ commons-codec-1.10.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.index.reindex.ReindexPlugin (Extension)
    -> org.elasticsearch.index.reindex.TransportReindexAction (Extension)
     -> org.elasticsearch.client.RestClient (Extension)
      -> org.apache.http.impl.auth.BasicScheme (Extension)
       -> ❌ org.apache.commons.codec.binary.Base64 (Vulnerable Component)

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-05-12

Fix Resolution: 1.13-RC1

WS-2017-3734

Vulnerable Library - httpclient-4.5.2.jar

Apache HttpComponents Client

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar

Dependency Hierarchy:

• transport-5.6.4.jar (Root Library)
  • reindex-client-5.6.4.jar
    • elasticsearch-rest-client-5.6.4.jar
      • ❌ httpclient-4.5.2.jar (Vulnerable Library)

Found in HEAD commit: 66f6cec7b61b92e8af1c753e55af1f6e28648f07

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.utils.ElasticsearchUtil (Application)
  -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension)
   -> org.elasticsearch.index.reindex.ReindexPlugin (Extension)
    -> org.elasticsearch.index.reindex.TransportReindexAction (Extension)
     -> org.elasticsearch.client.RestClient (Extension)
      -> ❌ org.apache.http.client.utils.URIBuilder (Vulnerable Component)

Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2017-01-21

URL: WS-2017-3734

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2017-01-21

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.3