Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-40829TLS hostname validation issues within AWS IoT Device SDKs on macOSMaven · software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk · fixed in 1.4.2
- CVE-2021-40828TLS hostname validation issues within AWS IoT Device SDKs on WindowsMaven · software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk · fixed in 1.3.3
- CVE-2021-22053Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted Maven · org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard · fixed in 2.2.10.RELEASE
- CVE-2021-41532Unauthenticated access to Ozone Recon HTTP endpointsMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-39236Owners of the S3 tokens are not validatedMaven · org.apache.hadoop:hadoop-ozone-ozone-manager · fixed in 1.2.0
- CVE-2021-39235Access mode of block tokens are not enforcedMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-39234Raw block data can be read bypassing ACL/authorizationMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-39233Container-related datanode operations can be called without authorizationMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-39232Missing admin check for SCM related admin commandsMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-39231Missing authentication/authorization on internal RPC endpointsMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-36372Original block tokens are persisted and can be retrievedMaven · org.apache.ozone:ozone-main · fixed in 1.2.0
- CVE-2021-37580Apache ShenYu Admin bypass JWT authenticationMaven · org.apache.shenyu:shenyu-admin · fixed in 2.4.1
- CVE-2021-41269Unauthenticated remote code injection in cron-utilsMaven · com.cronutils:cron-utils · fixed in 9.1.6
- CVE-2021-43578Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any Maven · org.jenkins-ci.plugins:squashtm-publisher-plugin
- CVE-2021-43577Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:dependency-check-jenkins-plugin · fixed in 5.1.2
- CVE-2021-43576Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackersMaven · org.jenkins-ci.plugins:pom2config
- CVE-2021-21701Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:performance
- CVE-2021-21700Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in aMaven · org.jenkins-ci.plugins:scriptler · fixed in 3.4
- CVE-2021-21699Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, Maven · org.biouno:uno-choice · fixed in 2.5.7
- CVE-2021-43570The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attaMaven · com.starkbank.ellipticcurve:starkbank-ecdsa · fixed in 1.0.1
- CVE-2021-43466In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code executioMaven · org.thymeleaf:thymeleaf-spring5 · fixed in 3.0.13.RELEASE
- CVE-2021-22051Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream serviMaven · org.springframework.cloud:spring-cloud-gateway · fixed in 3.0.5, 2.2.10.RELEASE0.5
- CVE-2021-21698Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller frMaven · org.jenkins-ci.plugins:subversion · fixed in 2.15.1
- CVE-2021-21697Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21696Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories whMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21695FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21694FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21692FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controllerMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21691Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21690Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319