Cvefix 2022 22965 #4

muldos · 2022-11-29T13:07:00Z

No description provided.

github-actions · 2022-11-30T12:47:58Z

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329
Medium	org.yaml:snakeyaml	1.28		org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854

github-actions · 2022-12-06T17:19:55Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750

github-actions · 2022-12-08T18:54:55Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329

github-actions · 2022-12-08T19:00:05Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750

github-actions · 2022-12-08T19:00:53Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854

github-actions · 2022-12-08T19:34:14Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329

…undle creation

gitguardian · 2022-12-09T12:54:16Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	Secret	Commit	Filename
5155551	Generic High Entropy Secret	`27153eb`	fake-creds.txt	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!}

github-actions · 2022-12-09T12:56:03Z

What is Frogbot?

SEVERITY	IMPACTED PACKAGE	VERSION	FIXED VERSIONS	COMPONENT	COMPONENT VERSION	CVE
Critical	org.springframework:spring-web	5.3.20	[6.0.0]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2016-1000027
High	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-25857
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4.1]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42003
High	com.fasterxml.jackson.core:jackson-databind	2.12.6.1	[2.12.7.1] [2.13.4]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42004
High	org.apache.tomcat.embed:tomcat-embed-core	9.0.63	[10.0.27] [10.1.1] [8.5.53] [9.0.68]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-42252
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-41854
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38750
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38749
Medium	org.yaml:snakeyaml	1.28	[1.31]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38751
Medium	org.yaml:snakeyaml	1.28	[1.32]	org.springframework.boot:spring-boot-starter-web	2.5.14	CVE-2022-38752
Medium	org.jetbrains.kotlin:kotlin-stdlib	1.5.32	[1.6.0]	com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter	5.4.3	CVE-2022-24329

muldos added 5 commits November 26, 2022 11:44

fix cve

e4027f4

remove the vulnerable code

b7978ca

add env 4

f207ef1

update label

7175d1e

fix version of spring shell

50a3b3c

muldos had a problem deploying to frogbot November 29, 2022 13:07 Failure

muldos had a problem deploying to frogbot November 30, 2022 12:46 Failure

update gh action workflow

62abd33

muldos temporarily deployed to frogbot December 6, 2022 17:18 Inactive

update workflow

0db6522

muldos temporarily deployed to frogbot December 8, 2022 18:53 — with GitHub Actions Inactive

update workflow

afba984

muldos temporarily deployed to frogbot December 8, 2022 18:58 — with GitHub Actions Inactive

update workflow

d5759da

muldos temporarily deployed to frogbot December 8, 2022 18:59 — with GitHub Actions Inactive

update cli version

c84c04c

muldos temporarily deployed to frogbot December 8, 2022 19:32 — with GitHub Actions Inactive

muldos added 7 commits December 9, 2022 13:48

update gh action various workflow

eda48bc

update gh action various workflow

afb282b

test to trigger frogbot

683ae41

test secret detection

acbbb63

test secret detection

f2d7405

test secret detection

928f1e0

fix fake creds file

ec85f5a

muldos added 5 commits December 9, 2022 13:48

add a fake creds file to test secret detection

4a804d2

add full scan and more steps to ease demos

467168d

update the build to add some custom metatdat to be used for release b…

27153eb

…undle creation

update gh action workflow

d31681f

update workflow

1c5e45a

muldos temporarily deployed to frogbot December 9, 2022 12:54 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Cvefix 2022 22965 #4

Cvefix 2022 22965 #4

Uh oh!

muldos commented Nov 29, 2022

Uh oh!

github-actions bot commented Nov 30, 2022

Uh oh!

github-actions bot commented Dec 6, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

gitguardian bot commented Dec 9, 2022

Uh oh!

github-actions bot commented Dec 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Cvefix 2022 22965 #4

Are you sure you want to change the base?

Cvefix 2022 22965 #4

Uh oh!

Conversation

muldos commented Nov 29, 2022

Uh oh!

github-actions bot commented Nov 30, 2022

Uh oh!

github-actions bot commented Dec 6, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

github-actions bot commented Dec 8, 2022

Uh oh!

gitguardian bot commented Dec 9, 2022

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

github-actions bot commented Dec 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants