org.codehaus.jackson
There is no non vulnerable version of this component.
False Positive
Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization.
appc doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on appc.
https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
This is a dependency indirectly from jackson-jaxrs. We do not use Jackson-mapper-asl directly and do not use createBeanDeserializer() function which has the vulnerability. We were unable to find any reference to this Vulnerability from appc code.
No Action Required
There is no non vulnerable version of this component.
False Positive
Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization.
appc doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on appc.
https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
This is a dependency indirectly from jersey-json. We do not use Jackson-mapper-asl directly and do not use createBeanDeserializer() function which has the vulnerability. We were unable to find any reference to this Vulnerability from appc code.
No Action Required
There is no non vulnerable version of this component.
False Positive
Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization.
appc doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on appc.
https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
appc codes using ObjectMapper:
There is no non vulnerable version of this component.
False Postive
Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization.
appc doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on appc.
https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
appc codes using ObjectMapper:
com.fasterxml.jackson.core
False Positive
Explanation
jackson-core is vulnerable to Denial of Service (DoS). The _reportInvalidToken() function in the UTF8StreamJsonParser and ReaderBasedJsonParser classes allows large amounts of extraneous data to be printed to the server log. An attacker can exploit this vulnerability by crafting a POST request containing large amounts of data. When the data contains invalid JSON, an exception is thrown, which results in the consumption of available disk space when the error message is written to server.log along with the request data.
appc doesn't use UTF8StreamJsonParser and ReaderBasedJsonParser classes
https://github.com/FasterXML/jackson-core/pull/322
appc codes using JsonParser/JasonProcessingExection/type.TypeReference:
False Positive
Explanation
The Apache httpcomponents component is vulnerable to Directory Traversal. The normalizePath() function in the URIBuilder class allows directory traversal characters such as ../. An attacker can exploit this vulnerability by sending a specially crafted request containing this sequence in the URL path, allowing the attacker to traverse beyond the allowed directory and retrieve the contents of arbitrary files from the server, leading to information disclosure.
This is a dependency indirectly from odl. We do not use normalizePath() function which has the vulnerability. We were unable to find any reference to this Vulnerability from appc code.
The following JIRA is tracking this issue:
False Positive.
Explanation
The Apache httpcomponents component is vulnerable to Directory Traversal. The normalizePath() function in the URIBuilder class allows directory traversal characters such as ../. An attacker can exploit this vulnerability by sending a specially crafted request containing this sequence in the URL path, allowing the attacker to traverse beyond the allowed directory and retrieve the contents of arbitrary files from the server, leading to information disclosure.
Detection
The application is vulnerable by using this component.
Recommendation
This is a dependency indirectly from odl. We do not use normalizePath() function which has the vulnerability. We were unable to find any reference to this Vulnerability from appc code.
The following JIRA is tracking this issue:
False Positive
Library not used by APPC code directly, but is contains in cdp-pal library.
The dependency comes from cdp-pal; however, this should not be a security concern as CDP-PAL/woorea does not host any urls for incoming GET requests and from what we read about the vulnerability it should not apply as grizzly-http is only used for outgoing calls. It is not used to allow incoming get requests.
Will follow-up with CDP-PAL to see if the version can be updated even though not a risk for APPC.
False Positive
Please read the item above for artifact: jackson-databind-2.8.1, which is the same group: com.fasterxml.jackson.core