GitSecure Vulnerability Report

[ralanlittle]

GitSecure Vulnerablility Report

✅ Manifest File: package-lock.json
✅ Manifest File: Dockerfile
✅ Manifest File: travis/Dockerfile
Vulnerabilities discovered in the following manifest file(s)

❌ Manifest File: pom.xml

Package Name: org.apache.commons:commons-compress Version : 1.18

Vulnerabilities

 CVE ID: GHSA-53x6-4x5p-rrvv
 Severity:  High
 Fixed in Version:  1.19
 Description:  The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

 CVE ID: CVE-2019-12402
 Severity:  High
 Fixed in Version:  1.19
 Description:  The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.