Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency vulnerability PRISMA-2023-0067 #938

Open
pechanuda opened this issue Oct 26, 2023 · 0 comments
Open

Dependency vulnerability PRISMA-2023-0067 #938

pechanuda opened this issue Oct 26, 2023 · 0 comments
Labels

Comments

@pechanuda
Copy link

Current Behavior

PrismaCloud scan reports following High vulnerability:

java	high	com.fasterxml.jackson.core_jackson-core		2.13.5	The Apache Software License, Version 2.0	7.5	fixed in 2.15.0	00:00.0		DoS - High, Has fix, High severity		com.fasterxml.jackson.core_jackson-core package versions before 2.15.0 are vulnerable to Denial of Service (DoS). The package does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended and leads to Uncontrolled Resource Consumption (\'Resource Exhaustion\').	

Expected Behavior

Dependent lib could be upgraded to 2.15.3, which is fixed.
https://github.com/adorsys/keycloak-config-cli/blob/main/pom.xml#L71

I have already tried to run all test container tests locally and there were now failures after increasing the jackson version to 2.15.3.

Steps To Reproduce

No response

Environment

  • keycloak-config-cli Version: 5.9.0

Anything else?

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant