retrofit-2.6.0.jar: 1 vulnerabilities (highest severity is: 7.5)

[copper-mend-app]

Vulnerable Library - retrofit-2.6.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/squareup/okio/okio/1.15.0/okio-1.15.0.jar

Found in HEAD commit: cb2e80a06eb3267b3dbec424c62003c9dfdad38e

Mend has checked all newer package trees, and you are on the least vulnerable package!

Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (retrofit version)	Fix PR available	Reachability
CVE-2023-3635	High	7.5	okio-1.15.0.jar	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-3635

Vulnerable Library - okio-1.15.0.jar

A modern I/O API for Java

Library home page: https://github.com/square/okio

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/squareup/okio/okio/1.15.0/okio-1.15.0.jar

Dependency Hierarchy:

• retrofit-2.6.0.jar (Root Library)
  • okhttp-3.12.0.jar
    • ❌ okio-1.15.0.jar (Vulnerable Library)

Found in HEAD commit: cb2e80a06eb3267b3dbec424c62003c9dfdad38e

Found in base branch: master

Vulnerability Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Publish Date: 2023-07-12

URL: CVE-2023-3635

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-3635

Release Date: 2023-07-12

Fix Resolution: com.squareup.okio:okio-jvm:3.4.0