mockserver-client-java-5.15.0.jar: 13 vulnerabilities (highest severity is: 8.8) #197
Description
Vulnerable Library - mockserver-client-java-5.15.0.jar
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (mockserver-client-java version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2025-48734 |  High |
8.8 | commons-beanutils-1.9.4.jar | Transitive | N/A* | ❌ |
| CVE-2024-34447 | High |
7.5 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2024-30172 | High |
7.5 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2024-29857 | High |
7.5 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2023-52428 | High |
7.5 | nimbus-jose-jwt-9.28.jar | Transitive | N/A* | ❌ |
| CVE-2024-30171 |  Medium |
5.9 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2025-53864 | Medium |
5.8 | nimbus-jose-jwt-9.28.jar | Transitive | N/A* | ❌ |
| CVE-2023-33202 | Medium |
5.5 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2023-2976 | Medium |
5.5 | guava-31.1-jre.jar | Transitive | N/A* | ❌ |
| CVE-2025-48924 | Medium |
5.3 | commons-lang3-3.17.0.jar | Transitive | N/A* | ❌ |
| CVE-2023-33201 | Medium |
5.3 | bcprov-jdk18on-1.72.jar | Transitive | N/A* | ❌ |
| CVE-2024-47554 | Medium |
4.3 | commons-io-2.11.0.jar | Transitive | N/A* | ❌ |
| CVE-2020-8908 |  Low |
3.3 | guava-31.1-jre.jar | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-48734
Vulnerable Library - commons-beanutils-1.9.4.jar
Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
Library home page: https://www.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.4/d52b9abcd97f38c81342bb7e7ae1eee9b73cba51/commons-beanutils-1.9.4.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- velocity-tools-generic-3.1.jar
- ❌ commons-beanutils-1.9.4.jar (Vulnerable Library)
- velocity-tools-generic-3.1.jar
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
Publish Date: 2025-05-28
URL: CVE-2025-48734
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-wxr5-93ph-8wr9
Release Date: 2025-05-28
Fix Resolution: commons-beanutils:commons-beanutils:1.11.0
Step up your Open Source Security Game with Mend here
CVE-2024-34447
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
Publish Date: 2024-05-03
URL: CVE-2024-34447
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-34447
Release Date: 2024-05-03
Fix Resolution: org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78, org.bouncycastle:bctls-fips:1.0.19
Step up your Open Source Security Game with Mend here
CVE-2024-30172
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
Publish Date: 2024-05-09
URL: CVE-2024-30172
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1
Step up your Open Source Security Game with Mend here
CVE-2024-29857
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
Publish Date: 2024-05-09
URL: CVE-2024-29857
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-8xfc-gm6g-vgpv
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1
Step up your Open Source Security Game with Mend here
CVE-2023-52428
Vulnerable Library - nimbus-jose-jwt-9.28.jar
Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)
Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.28/a91ba42d3b4dc9ee702c83b8201e28d96a0d44b4/nimbus-jose-jwt-9.28.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ nimbus-jose-jwt-9.28.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
Publish Date: 2024-02-11
URL: CVE-2023-52428
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428
Release Date: 2024-02-11
Fix Resolution: com.nimbusds:nimbus-jose-jwt:9.37.2
Step up your Open Source Security Game with Mend here
CVE-2024-30171
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
Publish Date: 2024-05-09
URL: CVE-2024-30171
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-v435-xc8x-wvr9
Release Date: 2024-05-09
Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1
Step up your Open Source Security Game with Mend here
CVE-2025-53864
Vulnerable Library - nimbus-jose-jwt-9.28.jar
Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)
Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.28/a91ba42d3b4dc9ee702c83b8201e28d96a0d44b4/nimbus-jose-jwt-9.28.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ nimbus-jose-jwt-9.28.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Publish Date: 2025-07-11
URL: CVE-2025-53864
CVSS 3 Score Details (5.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Step up your Open Source Security Game with Mend here
CVE-2023-33202
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
Publish Date: 2023-11-23
URL: CVE-2023-33202
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-wjxj-5m7g-mg7q
Release Date: 2023-11-23
Fix Resolution: org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73
Step up your Open Source Security Game with Mend here
CVE-2023-2976
Vulnerable Library - guava-31.1-jre.jar
Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.
Library home page: https://github.com/google/guava
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- ❌ guava-31.1-jre.jar (Vulnerable Library)
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Use of Java's default temporary directory for file creation in "FileBackedOutputStream" in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Publish Date: 2023-06-14
URL: CVE-2023-2976
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-7g45-4rm6-3mm3
Release Date: 2023-06-14
Fix Resolution: com.google.guava:guava:32.0.1-android,32.0.1-jre
Step up your Open Source Security Game with Mend here
CVE-2025-48924
Vulnerable Library - commons-lang3-3.17.0.jar
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
The code is tested using the latest revision of the JDK for supported
LTS releases: 8, 11, 17 and 21 currently.
See https://github.com/apache/commons-lang/blob/master/.github/workflows/maven.yml
Please ensure your build environment is up-to-date and kindly report any build issues.
Library home page: https://commons.apache.org/proper/commons-lang/
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-lang3/3.17.0/b17d2136f0460dcc0d2016ceefca8723bdf4ee70/commons-lang3-3.17.0.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- ❌ commons-lang3-3.17.0.jar (Vulnerable Library)
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-11
URL: CVE-2025-48924
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2025-07-11
Fix Resolution: org.apache.commons:commons-lang3:3.18.0
Step up your Open Source Security Game with Mend here
CVE-2023-33201
Vulnerable Library - bcprov-jdk18on-1.72.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.
Library home page: https://www.bouncycastle.org/java.html
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.72/d8dc62c28a3497d29c93fee3e71c00b27dff41b4/bcprov-jdk18on-1.72.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ bcprov-jdk18on-1.72.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Publish Date: 2023-07-05
URL: CVE-2023-33201
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2023-07-05
Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74
Step up your Open Source Security Game with Mend here
CVE-2024-47554
Vulnerable Library - commons-io-2.11.0.jar
The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Library home page: https://www.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/commons-io/commons-io/2.11.0/a2503f302b11ebde7ebc3df41daebe0e4eea3689/commons-io-2.11.0.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- mockserver-core-5.15.0.jar
- ❌ commons-io-2.11.0.jar (Vulnerable Library)
- mockserver-core-5.15.0.jar
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-10-03
URL: CVE-2024-47554
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
Release Date: 2024-10-03
Fix Resolution: commons-io:commons-io:2.14.0
Step up your Open Source Security Game with Mend here
CVE-2020-8908
Vulnerable Library - guava-31.1-jre.jar
Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.
Library home page: https://github.com/google/guava
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar
Dependency Hierarchy:
- mockserver-client-java-5.15.0.jar (Root Library)
- ❌ guava-31.1-jre.jar (Vulnerable Library)
Found in HEAD commit: 4aec944554929469596fa5e2776a405d5efce1c4
Found in base branch: master
Vulnerability Details
A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2020-12-10
URL: CVE-2020-8908
CVSS 3 Score Details (3.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2020-12-10
Fix Resolution: https://github.com/google/guava.git - v32.0.0
Step up your Open Source Security Game with Mend here