This table represents the known exploitable and non-exploitable vulnerabilities in third party packages used in the project.
| Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| msb-apigateway | com.fasterxml.jackson.core | False Positive Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-apigateway doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-apigateway. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-apigateway codes using ObjectMapper: | Not applicable |
| msb-discovery | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-discovery codes using ObjectMapper: | Not applicable |
| msb-discovery | com.smoketurner.dropwizard | False positive. Explanation: It's also caused by jackson-databind. This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. Msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. | |
| msb-java-sdk | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-java-sdk doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization | Not applicable |
msb-swagger-sdk | com.fasterxml.jackson.core | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | com.fasterxml.jackson.dataformat | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | commons-beanutils | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
| msb-swagger-sdk | commons-collections | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |