Skip to content

[Snyk] Fix for 52 vulnerabilities - #34

Open
crashdump wants to merge 1 commit into
masterfrom
snyk-fix-8f4a2bdcbf6964f2a3e8c83a1bfb5be9
Open

[Snyk] Fix for 52 vulnerabilities#34
crashdump wants to merge 1 commit into
masterfrom
snyk-fix-8f4a2bdcbf6964f2a3e8c83a1bfb5be9

Conversation

@crashdump

@crashdump crashdump commented Mar 26, 2025

Copy link
Copy Markdown
Member

snyk-top-banner

Snyk has created this PR to fix 52 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • parent/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
critical severity Remote Code Execution
SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751		   691   No Path Found Mature
critical severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-572732		   489   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-ORGJSON-2841369		   267   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
Reachable Proof of Concept
medium severity Arbitrary Code Execution
SNYK-JAVA-LOG4J-2316893		   245   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-ORGYAML-2806360		   190   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
Reachable No Known Exploit
critical severity Command Injection
SNYK-JAVA-ORGAPACHEMAVENSHARED-570592		   188   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342647		   183   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Use After Free
SNYK-JAVA-COMGITHUBJNR-1570422		   166   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity SQL Injection
SNYK-JAVA-LOG4J-2342645		   165   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342646		   165   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGJSON-5488379		   159   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
high severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGJSON-5962464		   159   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
high severity Insecure Encryption
SNYK-JAVA-ORGBOUNCYCASTLE-32366		   145   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Insecure Encryption
SNYK-JAVA-ORGBOUNCYCASTLE-32368		   145   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGYAML-537645		   144   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
Reachable Proof of Concept
high severity Insufficient Validation
SNYK-JAVA-ORGBOUNCYCASTLE-32340		   115   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Information Exposure
SNYK-JAVA-ORGBOUNCYCASTLE-1035561		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Insecure Encryption
SNYK-JAVA-ORGBOUNCYCASTLE-32361		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Insecure Encryption
SNYK-JAVA-ORGBOUNCYCASTLE-32362		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Signature Validation Bypass
SNYK-JAVA-ORGBOUNCYCASTLE-32364		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Insecure Encryption
SNYK-JAVA-ORGBOUNCYCASTLE-32369		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-5564390		   114   No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGYAML-6056527		   114   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Multipart Content Pollution
SNYK-JAVA-ORGSPRINGFRAMEWORK-460644		   106   No Path Found No Known Exploit
medium severity Deserialization of Untrusted Data
SNYK-JAVA-COMGOOGLEGUAVA-32236		   104   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217		   104   No Path Found No Known Exploit
high severity Insecure Temporary File
SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-2438287		   104   No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-LOG4J-3358774		   101   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Timing Attack
SNYK-JAVA-ORGBOUNCYCASTLE-32363		   101   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Cryptographic Issues
SNYK-JAVA-ORGBOUNCYCASTLE-32367		   101   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313		   91   No Path Found No Known Exploit
low severity Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016888		   60   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
medium severity Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016891		   59   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
low severity Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634		   57   No Path Found Proof of Concept
low severity Information Disclosure
SNYK-JAVA-COMGOOGLEGUAVA-1015415		   47   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found Proof of Concept
medium severity Directory Traversal
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517		   46   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Improper Input Validation
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1048058		   45   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
medium severity Directory Traversal
SNYK-JAVA-ORGCODEHAUSPLEXUS-31521		   45   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
org.codehaus.plexus:plexus-interactivity-api:
1.0-alpha-6 -> 1.1
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828		   45   No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749		   45   No Path Found No Known Exploit
medium severity XML External Entity (XXE) Injection
SNYK-JAVA-ORGCODEHAUSPLEXUS-461102		   41   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
org.codehaus.plexus:plexus-interactivity-api:
1.0-alpha-6 -> 1.1
No Path Found No Known Exploit
medium severity Improper Output Neutralization for Logs
SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097		   41   No Path Found No Known Exploit
medium severity Improper Input Validation
SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878		   41   No Path Found No Known Exploit
low severity Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3113851		   41   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Information Exposure
SNYK-JAVA-COMMONSCODEC-561518		   40   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Man-in-the-Middle (MitM)
SNYK-JAVA-LOG4J-1300176		   40   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Information Exposure
SNYK-JAVA-ORGBOUNCYCASTLE-173771		   40   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Insufficient Validation
SNYK-JAVA-ORGBOUNCYCASTLE-32365		   40   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364		   40   No Path Found No Known Exploit
low severity Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365		   40   No Path Found No Known Exploit
low severity Stack-based Buffer Overflow
SNYK-JAVA-ORGYAML-3016889		   40   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit
low severity Creation of Temporary File in Directory with Insecure Permissions
SNYK-JAVA-COMGOOGLEGUAVA-5710356		   30   io.fabric8:docker-maven-plugin:
0.20.0 -> 0.43.1
No Path Found No Known Exploit

Vulnerabilities that could not be fixed

  • Upgrade:
    • Could not upgrade io.fabric8:fabric8-maven-generator-spring-boot@3.3-SNAPSHOT to io.fabric8:fabric8-maven-generator-spring-boot@3.4.0; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use After Free
🦉 Creation of Temporary File in Directory with Insecure Permissions
🦉 Arbitrary Code Execution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: parent/pom.xml to reduce vulnerabilities
05a2ad9 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-572732
- https://snyk.io/vuln/SNYK-JAVA-ORGJSON-2841369
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2316893
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMAVENSHARED-570592
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342647
- https://snyk.io/vuln/SNYK-JAVA-COMGITHUBJNR-1570422
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342645
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342646
- https://snyk.io/vuln/SNYK-JAVA-ORGJSON-5488379
- https://snyk.io/vuln/SNYK-JAVA-ORGJSON-5962464
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32366
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32368
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-537645
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32340
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-1035561
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32361
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32362
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32364
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32369
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-5564390
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-6056527
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-460644
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-32236
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-2438287
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-3358774
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32363
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32367
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016888
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016891
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1048058
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3113851
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-1300176
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-173771
- https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32365
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365
- https://snyk.io/vuln/SNYK-JAVA-ORGYAML-3016889
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-5710356
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@crashdump @snyk-bot