chore(deps): update dependency neo4j/neo4j to v5.24.2

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
neo4j/neo4j	patch	5.24.1 -> 5.24.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

neo4j/neo4j (neo4j/neo4j)

v5.24.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/neo4j:5.24.2

📦 Image Reference ghcr.io/uniget-org/tools/neo4j:5.24.2

digest	sha256:7cec64b5abb78f91530e587ab609036fedde416eeb45a7088a530881fa0e215f
vulnerabilities
platform	linux/amd64
size	128 MB
packages	241

protobuf-java 3.25.2 (maven) pkg:maven/com.google.protobuf/protobuf-java@3.25.2 Improper Input Validation Affected range <3.25.5 Fixed version 3.25.5 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team ecosystem@trailofbits.com Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime. Severity CVE-2024-7254 High CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests (Protobuf Java LiteTest and CodedInputStreamTest) that identify the specific inputs that exercise this parsing weakness. Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages: protobuf-java (3.25.5, 4.27.5, 4.28.2) protobuf-javalite (3.25.5, 4.27.5, 4.28.2) protobuf-kotlin (3.25.5, 4.27.5, 4.28.2) protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2) com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)

jetty-server 10.0.20 (maven) pkg:maven/org.eclipse.jetty/jetty-server@10.0.20 Uncontrolled Resource Consumption Affected range >=10.0.0 <=10.0.23 Fixed version 10.0.24 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact Remote DOS attack can cause out of memory Description There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory. Affected Versions Jetty 12.0.0-12.0.8 (Supported) Jetty 11.0.0-11.0.23 (EOL) Jetty 10.0.0-10.0.23 (EOL) Jetty 9.3.12-9.4.55 (EOL) Patched Versions Jetty 12.0.9 Jetty 11.0.24 Jetty 10.0.24 Jetty 9.4.56 Workarounds Do not use ThreadLimitHandler. Consider use of QoSHandler instead to artificially limit resource utilization. References Jetty 12 - jetty/jetty.project#11723

jetty-http 10.0.20 (maven) pkg:maven/org.eclipse.jetty/jetty-http@10.0.20 Improper Validation of Syntactic Correctness of Input Affected range >=7.0.0 <=12.0.11 Fixed version 12.0.12 CVSS Score 3.7 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Description Summary Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks. Details Affected components The vulnerable component is the HttpURI class when used as a utility class in an application. The Jetty usage of the class is not vulnerable. Attack overview The HttpURI class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed. Moreover, the interpretation of what part of the authority is the host name differs from a common browser in that they also do not fail, but they select a different host name from the illegal URI. Attack scenario A typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI. This attack occurs when the Validator is the org.eclipse.jetty.http.HttpURI class and the Requester is the Browser (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., http://browser.check%23%40vulndetector.com/ ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname vulndetector.com. PoC payloads: http://browser.check &@vulndetector.com/ http://browser.check #@vulndetector.com/ http://browser.check?@vulndetector.com/ http://browser.check#@vulndetector.com/ http://vulndetector.com\\/ The problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open "browser.check", and jetty will parse this URL as "vulndetector.com". <a href="http://browser.check#@vulndetector.com/"></a> A comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid). Invalid URI Jetty Chrome http://browser.check &@vulndetector.com/ vulndetector.com browser.check http://browser.check #@vulndetector.com/ vulndetector.com browser.check http://browser.check?@vulndetector.com/ vulndetector.com browser.check http://browser.check#@vulndetector.com/ vulndetector.com browser.check The problem of 302 redirect parsing in HTTP 302 Location Input Jetty Chrome http://browser.check%5c/ browser.check\ browser.check It is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5]. Impact The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly. Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section. The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to SSRF[1] and URL Redirection[2] vulnerabilities in several cases. Mitigation The attacks outlined above rely on decoded user data being passed to the HttpURI class. Application should not pass decoded user data as an encoded URI to any URI class/method, including HttpURI. Such applications are likely to be vulnerable in other ways. The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per RFC9110 Section 4.2.4. Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser). Reference [1] https://cwe.mitre.org/data/definitions/918.html [2] https://cwe.mitre.org/data/definitions/601.html

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/11350596807.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/11350596807.