Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2023-46122 (High) detected in io_2.13-1.9.1.jar - autoclosed #3547

Closed
mend-for-github-com bot opened this issue Oct 25, 2023 · 1 comment
Closed

CVE-2023-46122 (High) detected in io_2.13-1.9.1.jar - autoclosed #3547

mend-for-github-com bot opened this issue Oct 25, 2023 · 1 comment
Assignees
@dlvenable
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Milestone
v2.6

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Oct 25, 2023 •
edited
Loading

CVE-2023-46122 - High Severity Vulnerability

Vulnerable Library - io_2.13-1.9.1.jar

IO module for sbt

Library home page: https://github.com/sbt/io

Path to dependency file: /performance-test/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.scala-sbt/io_2.13/1.9.1/ea166891cd1713dd95289fbfb791e60a5decaf3c/io_2.13-1.9.1.jar

Dependency Hierarchy:

  • zinc_2.13-1.9.3.jar (Root Library)
    • zinc-compile-core_2.13-1.9.3.jar
      • ❌ io_2.13-1.9.1.jar (Vulnerable Library)

Found in HEAD commit: 90bdaa7e7833bdd504c817e49d4434b4d8880f56

Found in base branch: main

Vulnerability Details

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Publish Date: 2023-10-23

URL: CVE-2023-46122

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-46122

Release Date: 2023-10-23

Fix Resolution: org.scala-sbt:io:1.9.7
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label Oct 25, 2023
@dlvenable dlvenable added this to the v2.6 milestone Oct 31, 2023
@mend-for-github-com mend-for-github-com bot changed the title CVE-2023-46122 (Low) detected in io_2.13-1.6.0.jar CVE-2023-46122 (High) detected in io_2.13-1.6.0.jar Nov 1, 2023
@mend-for-github-com mend-for-github-com bot changed the title CVE-2023-46122 (High) detected in io_2.13-1.6.0.jar CVE-2023-46122 (High) detected in io_2.13-1.9.1.jar Nov 7, 2023
dlvenable added a commit to dlvenable/data-prepper that referenced this issue Nov 21, 2023
@dlvenable
Updates the opensearch-java client to 2.8.1 and opensearch to 1.3.13.…
79cda55 
… This includes a transitive dependency update to parsson to resolve CVE-2023-4043.

Update required version of org.json library to resolve CVE-2023-5072. Require a Zookeeper version which resolves CVE-2023-44981. Require a transitive Scala library to resolve CVE-2023-46122.

Resolves opensearch-project#3588, opensearch-project#3522, opensearch-project#3491, opensearch-project#3547

Signed-off-by: David Venable <[email protected]>
@dlvenable dlvenable mentioned this issue Nov 21, 2023
Merged
4 tasks
@dlvenable dlvenable self-assigned this Nov 21, 2023
dlvenable added a commit that referenced this issue Nov 27, 2023
@dlvenable
Updates the opensearch-java client to 2.8.1 and opensearch to 1.3.13.…
37e18a5 
… This includes a transitive dependency update to parsson to resolve CVE-2023-4043. (#3689)

Update required version of org.json library to resolve CVE-2023-5072. Require a Zookeeper version which resolves CVE-2023-44981. Require a transitive Scala library to resolve CVE-2023-46122.

Resolves #3588, #3522, #3491, #3547

Signed-off-by: David Venable <[email protected]>
@mend-for-github-com mend-for-github-com bot changed the title CVE-2023-46122 (High) detected in io_2.13-1.9.1.jar CVE-2023-46122 (High) detected in io_2.13-1.9.1.jar - autoclosed Nov 27, 2023
@mend-for-github-com Mend for GitHub.com
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from Unplanned to Done in Data Prepper Tracking Board Nov 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dlvenable dlvenable

Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Projects
Data Prepper Tracking Board
Archived in project
Milestone
v2.6
Development

No branches or pull requests
1 participant
@dlvenable