Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed #14180

Closed
mend-for-github-com bot opened this issue Jun 11, 2024 · 30 comments
Labels
good first issue Good for newcomers Mend: dependency security vulnerability Security vulnerability detected by WhiteSource Storage:Snapshots untriaged

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Jun 11, 2024

Vulnerable Library - hadoop-minicluster-3.4.0.jar

Path to dependency file: /test/fixtures/hdfs-fixture/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/dnsjava/dnsjava/3.4.0/a214858bba6ddc017a3c2fd5d17f0ee359770dad/dnsjava-3.4.0.jar

Found in HEAD commit: cc98dbe411df77b04e82507b3d29e90e54bc87d3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (hadoop-minicluster version) Remediation Possible**
CVE-2024-25638 High 8.9 dnsjava-3.4.0.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-25638

Vulnerable Library - dnsjava-3.4.0.jar

dnsjava is an implementation of DNS in Java. It supports all defined record types (including the DNSSEC types), and unknown types. It can be used for queries, zone transfers, and dynamic updates. It includes a cache which can be used by clients, and a minimal implementation of a server. It supports TSIG authenticated messages, partial DNSSEC verification, and EDNS0.

Library home page: https://github.com/dnsjava/dnsjava

Path to dependency file: /test/fixtures/hdfs-fixture/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/dnsjava/dnsjava/3.4.0/a214858bba6ddc017a3c2fd5d17f0ee359770dad/dnsjava-3.4.0.jar

Dependency Hierarchy:

  • hadoop-minicluster-3.4.0.jar (Root Library)
    • hadoop-common-3.4.0.jar
      • dnsjava-3.4.0.jar (Vulnerable Library)

Found in HEAD commit: cc98dbe411df77b04e82507b3d29e90e54bc87d3

Found in base branch: main

Vulnerability Details

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Publish Date: 2024-07-22

URL: CVE-2024-25638

CVSS 3 Score Details (8.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cfxw-4h78-h7fw

Release Date: 2024-07-22

Fix Resolution: dnsjava:dnsjava:3.6.0

@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label Jun 11, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed Jun 11, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) Jun 11, 2024
@mend-for-github-com mend-for-github-com bot reopened this Jun 11, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@andrross
Copy link
Member

[Triage - attendees 1 2 3 4 5]

Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed Jun 13, 2024
@github-project-automation github-project-automation bot moved this from 🆕 New to ✅ Done in Storage Project Board Jun 13, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) Jun 14, 2024
@mend-for-github-com mend-for-github-com bot reopened this Jun 14, 2024
@github-project-automation github-project-automation bot moved this from ✅ Done to 🏗 In progress in Storage Project Board Jun 14, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed Jun 14, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in Storage Project Board Jun 14, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed hadoop-minicluster-3.4.0.jar: 3 vulnerabilities (highest severity is: 7.5) Jun 17, 2024
@mend-for-github-com mend-for-github-com bot reopened this Jun 17, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@github-project-automation github-project-automation bot moved this from ✅ Done to 🏗 In progress in Storage Project Board Jun 17, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from Ready To Be Picked to ✅ Done in Storage Project Board Jul 29, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) Jul 31, 2024
@mend-for-github-com mend-for-github-com bot reopened this Jul 31, 2024
@github-project-automation github-project-automation bot moved this from ✅ Done to 🏗 In progress in Storage Project Board Jul 31, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed Jul 31, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in Storage Project Board Jul 31, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) Aug 2, 2024
@mend-for-github-com mend-for-github-com bot reopened this Aug 2, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@github-project-automation github-project-automation bot moved this from ✅ Done to 🏗 In progress in Storage Project Board Aug 2, 2024
@dblock
Copy link
Member

dblock commented Aug 5, 2024

@varun-lodaya this keeps getting auto-opened and closed, something looks fishy

[Catch All Triage - 1, 2, 3]

@dblock dblock removed the untriaged label Aug 5, 2024
@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed Aug 7, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in Storage Project Board Aug 7, 2024
Copy link
Contributor Author

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) Aug 13, 2024
@mend-for-github-com mend-for-github-com bot reopened this Aug 13, 2024
@github-project-automation github-project-automation bot moved this from ✅ Done to 🏗 In progress in Storage Project Board Aug 13, 2024
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

@mend-for-github-com mend-for-github-com bot changed the title hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) hadoop-minicluster-3.4.0.jar: 1 vulnerabilities (highest severity is: 8.9) - autoclosed Aug 13, 2024
@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in Storage Project Board Aug 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers Mend: dependency security vulnerability Security vulnerability detected by WhiteSource Storage:Snapshots untriaged
Projects
Status: ✅ Done
Development

No branches or pull requests

4 participants