Skip to content

Conversation

@orsagie
Copy link
Owner

@orsagie orsagie commented Oct 15, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-1009829
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-174736
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-31507
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-31573
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-32043
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-32044
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-32111
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-450207
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-450917
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-455617
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467014
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467015
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467016
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-469674
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-469676
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-471943
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-472980
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-540500
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-548451
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No Proof of Concept
high severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-559094
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No Proof of Concept
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-560762
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-560766
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561362
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561373
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561585
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561586
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561587
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-564887
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-564888
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-570625
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-572300
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-572314
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-572316
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-608664
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72445
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72446
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72447
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72882
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72883
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1
Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-72884
com.fasterxml.jackson.core:jackson-databind:
2.7.6 -> 2.9.10.6
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9
Deserialization of Untrusted Data
SNYK-JAVA-COMGOOGLEGUAVA-32236
com.google.guava:guava:
15.0 -> 24.1.1-android
No No Known Exploit
high severity 876/1000
Why? Mature exploit, Has a fix available, CVSS 9.8
Deserialization of Untrusted Data
SNYK-JAVA-COMMONSCOLLECTIONS-30078
commons-collections:commons-collections:
3.2.1 -> 3.2.2
No Mature
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6
Deserialization of Untrusted Data
SNYK-JAVA-COMMONSCOLLECTIONS-472711
commons-collections:commons-collections:
3.2.1 -> 3.2.2
No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Directory Traversal
SNYK-JAVA-COMSPARKJAVA-31646
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-JAVA-COMSPARKJAVA-461007
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
medium severity 611/1000
Why? Recently disclosed, Has a fix available, CVSS 6.5
Improper Input Validation
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1016906
org.apache.httpcomponents:httpclient:
4.3.2 -> 4.5.13
No No Known Exploit
medium severity 484/1000
Why? Has a fix available, CVSS 5.4
Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
org.apache.httpcomponents:httpclient:
4.3.2 -> 4.5.13
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3
Denial of Service (DoS)
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30647
org.apache.httpcomponents:httpclient:
4.3.2 -> 4.5.13
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Directory Traversal
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517
org.apache.httpcomponents:httpclient:
4.3.2 -> 4.5.13
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9
Denial of Service (DoS)
SNYK-JAVA-ORGECLIPSEJETTY-174011
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-JAVA-ORGECLIPSEJETTY-174560
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Timing Attack
SNYK-JAVA-ORGECLIPSEJETTY-32151
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 654/1000
Why? Has a fix available, CVSS 8.8
Session Hijacking
SNYK-JAVA-ORGECLIPSEJETTY-32381
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Cache Poisoning
SNYK-JAVA-ORGECLIPSEJETTY-32383
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Authorization Bypass
SNYK-JAVA-ORGECLIPSEJETTY-32384
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8
Authorization Bypass
SNYK-JAVA-ORGECLIPSEJETTY-32385
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Cache Poisoning
SNYK-JAVA-ORGECLIPSEJETTY-460763
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-JAVA-ORGECLIPSEJETTY-461008
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-JAVA-ORGECLIPSEJETTY-461009
com.sparkjava:spark-core:
2.6.0 -> 2.9.1
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-1009829
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-174736
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-31507
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-31573
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-32043
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-32044
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-32111
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-450207
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-450917
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-455617
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-467014
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-467015
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-467016
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-469674
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-469676
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-471943
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-472980
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-540500
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-548451
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-559094
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-560762
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-560766
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-561362
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-561373
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-561585
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-561586
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-561587
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-564887
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-564888
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-570625
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-572300
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-572314
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-572316
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-608664
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72445
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72446
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72447
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72882
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72883
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72884
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-32236
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-472711
- https://snyk.io/vuln/SNYK-JAVA-COMSPARKJAVA-31646
- https://snyk.io/vuln/SNYK-JAVA-COMSPARKJAVA-461007
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1016906
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30647
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-31517
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-174011
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-174560
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-32151
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-32381
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-32383
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-32384
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-32385
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-460763
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-461008
- https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-461009
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants