Skip to content

fix 5 security vulns

Andreas Redmer requested to merge ar-/f-droid-client:fix_security_vuln_20220321 into master
  • Upgrade commons-io:commons-io@2.6 to commons-io:commons-io@2.7
  • Upgrade org.bouncycastle:bcprov-jdk15on@1.65 to org.bouncycastle:bcprov-jdk15on@1.67
  • Upgrade com.fasterxml.jackson.core:jackson-databind@2.11.1 to com.fasterxml.jackson.core:jackson-databind@2.13.2

commons-io:commons-io@2.6

CVE-2021-29425: Affected versions of this package are vulnerable to Directory Traversal via calling the method FileNameUtils.normalize using an improper string like //../foo or \..\foo, which may allow access to files in the parent directory.

org.bouncycastle:bcprov-jdk15on@1.65

CVE-2020-28052: Affected versions of this package are vulnerable to Comparison Using Wrong Factors. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

CVE-2020-15522: Affected versions of this package are vulnerable to Timing Attack. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

com.fasterxml.jackson.core:jackson-databind@2.11.1

CVE-2020-36518: Affected versions of this package are vulnerable to Denial of Service (DoS) via a large depth of nested objects.

another CWE-400: Affected versions of this package are vulnerable to Denial of Service (DoS) when using JDK serialization to serialize and deserialize JsonNode values. It is possible for the attacker to send a 4-byte length payload, with a value of Integer.MAX_VALUE , that will eventually cause large buffer allocation and out of heap memory.

Merge request reports