Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Security upgrade com.mycila:license-maven-plugin-git from 3.0 to 4.2 #53

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

[Snyk] Security upgrade com.mycila:license-maven-plugin-git from 3.0 to 4.2 #53

wants to merge 1 commit into from

Conversation

saden1
Copy link
Member

@saden1 saden1 commented Oct 3, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • tools/coding-conventions/pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
low severity 486/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.3		 Information Disclosure
SNYK-JAVA-COMGOOGLEGUAVA-1015415		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Deserialization of Untrusted Data
SNYK-JAVA-COMGOOGLEGUAVA-32236		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
low severity 379/1000
Why? Has a fix available, CVSS 3.3		 Creation of Temporary File in Directory with Insecure Permissions
SNYK-JAVA-COMGOOGLEGUAVA-5710356		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 681/1000
Why? Mature exploit, Has a fix available, CVSS 5.9		 Directory Traversal
SNYK-JAVA-COMJCRAFT-30302		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes Mature
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Information Exposure
SNYK-JAVA-COMMONSCODEC-561518		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Man-in-the-Middle (MitM)
SNYK-JAVA-LOG4J-1300176		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 651/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.6		 Arbitrary Code Execution
SNYK-JAVA-LOG4J-2316893		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 SQL Injection
SNYK-JAVA-LOG4J-2342645		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342646		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342647		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JAVA-LOG4J-3358774		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-572732		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1048058		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		 Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Directory Traversal
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-451097		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Directory Traversal
SNYK-JAVA-ORGCODEHAUSPLEXUS-31521		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Shell Command Injection
SNYK-JAVA-ORGCODEHAUSPLEXUS-31522		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit
low severity 380/1000
Why? Has a fix available, CVSS 3.1		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGCODEHAUSPLEXUS-461102		 com.mycila:license-maven-plugin-git:
3.0 -> 4.2
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Creation of Temporary File in Directory with Insecure Permissions
🦉 Directory Traversal
🦉 Arbitrary Code Execution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: tools/coding-conventions/pom.xml to reduce vulnerabilities
a821a24 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-32236
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-5710356
- https://snyk.io/vuln/SNYK-JAVA-COMJCRAFT-30302
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-1300176
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2316893
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342645
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342646
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342647
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-3358774
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-572732
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1048058
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-451097
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@saden1 @snyk-bot