Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

coil-base-2.4.0.aar: 1 vulnerabilities (highest severity is: 5.9) - autoclosed #86

Closed
mend-bolt-for-github bot opened this issue Nov 3, 2024 · 1 comment · Fixed by #133
Closed

coil-base-2.4.0.aar: 1 vulnerabilities (highest severity is: 5.9) - autoclosed #86

mend-bolt-for-github bot opened this issue Nov 3, 2024 · 1 comment · Fixed by #133
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Nov 3, 2024 •
edited
Loading

Vulnerable Library - coil-base-2.4.0.aar

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okio/okio-jvm/3.3.0/441db5e3f85f26d8891b7ae05cffb9a1a67ee54f/okio-jvm-3.3.0.pom

Found in HEAD commit: 77a89ac5bd1696a91ab9e7654223c13959e4b2c1

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (coil-base version) Remediation Possible**
CVE-2023-3635 Medium 5.9 okio-jvm-3.3.0.jar Transitive 2.5.0 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-3635

Vulnerable Library - okio-jvm-3.3.0.jar

A modern I/O API for Java

Library home page: https://github.com/square/okio/

Path to dependency file: /app/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.squareup.okio/okio-jvm/3.3.0/441db5e3f85f26d8891b7ae05cffb9a1a67ee54f/okio-jvm-3.3.0.pom

Dependency Hierarchy:

  • coil-base-2.4.0.aar (Root Library)
    • okio-3.3.0.jar
      • ❌ okio-jvm-3.3.0.jar (Vulnerable Library)

Found in HEAD commit: 77a89ac5bd1696a91ab9e7654223c13959e4b2c1

Found in base branch: develop

Vulnerability Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Publish Date: 2023-07-12

URL: CVE-2023-3635

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-3635

Release Date: 2023-07-12

Fix Resolution (com.squareup.okio:okio-jvm): 3.4.0

Direct dependency fix Resolution (io.coil-kt:coil-base): 2.5.0

Step up your Open Source Security Game with Mend here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Nov 3, 2024
FelberMartin added a commit that referenced this issue Nov 21, 2024
@FelberMartin
Upgrade coil for #86
3d0c1fc
@FelberMartin FelberMartin mentioned this issue Nov 21, 2024
Merged
@FelberMartin FelberMartin linked a pull request Nov 21, 2024 that will close this issue
Chore: Fix mend vulnerabilities #133
Merged
@mend-bolt-for-github mend-bolt-for-github bot changed the title coil-base-2.4.0.aar: 1 vulnerabilities (highest severity is: 5.9) coil-base-2.4.0.aar: 1 vulnerabilities (highest severity is: 5.9) - autoclosed Nov 22, 2024
@mend-bolt-for-github Mend Bolt for GitHub
Copy link
Contributor Author

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Chore: Fix mend vulnerabilities ls1intum/artemis-android
0 participants