Vulnerability Fixes and Workload Identity Enablement
New Feature: Updated OSDU Core Lib Azure supports workload identity capabilities.
pom.xml
Fix: Resolve vulnerabilities in This PR highlights the vulnerabilities that have been resolved in pom.xml
. Below is the delta of vulnerabilities that were present in the previous scan but are no longer found in the current state.
Resolved Vulnerabilities:
-
com.azure:azure-identity
- Vulnerability: CVE-2024-35255
- Severity: Medium
- Issue: Azure Identity Libraries Elevation of Privilege Vulnerability
-
Resolution: Upgraded from
1.11.2
to1.12.2
.
-
com.nimbusds:nimbus-jose-jwt
- Vulnerability: CVE-2023-52428
- Severity: Medium
-
Issue: Large JWE
p2c
header value causes Denial of Service -
Resolution: Upgraded from
9.30.2
to9.37.2
.
-
io.netty:netty-common
- Vulnerability: CVE-2024-47535
- Severity: Medium
- Issue: Denial of Service attack on Windows apps using Netty
-
Resolution: Upgraded from
4.1.114.Final
to4.1.115
.
-
org.springframework:spring-beans
- Vulnerability: CVE-2024-38827
- Severity: Medium
- Issue: Authorization bypass for case-sensitive comparisons in Spring Security
-
Resolution: Upgraded from
6.1.6
to6.1.14
.
-
org.springframework:spring-context
- Vulnerability: CVE-2024-38820
- Severity: Medium
- Issue: DataBinder vulnerability related to disallowedFieldspatterns
- Resolution: Addressed through updated libraries.
By resolving these vulnerabilities, the project achieves improved security and mitigates associated risks. Please review and approve this PR.
Merge request reports
Activity
Please register or sign in to reply