Skip to content
This repository has been archived by the owner on Jan 19, 2024. It is now read-only.

[Snyk] Security upgrade org.mule.modules:mule-module-cxf from 3.8.0 to 3.9.0 #19

Open
wants to merge 1 commit into
base: 3.8
Choose a base branch
from
Open

[Snyk] Security upgrade org.mule.modules:mule-module-cxf from 3.8.0 to 3.9.0 #19

wants to merge 1 commit into from

Conversation

svc-ast-gh-snyk5
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-174153		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 XML External Entity (XXE) Injection
SNYK-JAVA-DOM4J-2812975		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 629/1000
Why? Has a fix available, CVSS 8.3		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-1039798		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 519/1000
Why? Has a fix available, CVSS 6.1		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-30582		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Session Fixation
SNYK-JAVA-ORGAPACHECXF-31429		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JAVA-ORGAPACHECXF-3168313		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHECXF-31691		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHECXF-542666		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JAVA-ORGAPACHESANTUARIO-1655558		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Insertion of Sensitive Information into Log File
SNYK-JAVA-ORGAPACHESANTUARIO-6017551		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGJDOM-1311147		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGMULEMODULES-31249		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Improper Certificate Validation
SNYK-JAVA-ORGOPENSAML-30140		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGOPENSAML-30141		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Certificate Validation
SNYK-JAVA-ORGOPENSAML-31268		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
medium severity 489/1000
Why? Has a fix available, CVSS 5.5		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-30164		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Reflected File Download
SNYK-JAVA-ORGSPRINGFRAMEWORK-30165		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31323		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31326		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31327		 org.mule.modules:mule-module-cxf:
3.8.0 -> 3.9.0
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 XML External Entity (XXE) Injection
🦉 Cross-site Scripting (XSS)
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn

@snyk-bot @svc-ast-gh-snyk1
fix: pom.xml to reduce vulnerabilities
d978a34 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-DOM4J-174153
- https://snyk.io/vuln/SNYK-JAVA-DOM4J-2812975
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-1039798
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-30582
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-31429
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-3168313
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-31691
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECXF-542666
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-1655558
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-6017551
- https://snyk.io/vuln/SNYK-JAVA-ORGJDOM-1311147
- https://snyk.io/vuln/SNYK-JAVA-ORGMULEMODULES-31249
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30140
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-30141
- https://snyk.io/vuln/SNYK-JAVA-ORGOPENSAML-31268
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30164
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30165
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31323
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31326
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31327
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
cla:signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@svc-ast-gh-snyk5 @snyk-bot