WS-2021-0419 (High) detected in gson-2.8.8.jar, gson-2.8.0.jar
mend-bolt-for-github opened this issue · 1 comments
WS-2021-0419 - High Severity Vulnerability
Vulnerable Libraries - gson-2.8.8.jar, gson-2.8.0.jar
gson-2.8.8.jar
Library home page: https://github.com/google/gson
Path to dependency file: FastAsyncVoxelSniper/build.gradle.kts
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.code.gson/gson/2.8.8/431fc3cbc0ff81abdbfde070062741089c3ba874/gson-2.8.8.jar
Dependency Hierarchy:
- Paster-1.1.1.jar (Root Library)
- ❌ gson-2.8.8.jar (Vulnerable Library)
gson-2.8.0.jar
Gson JSON library
Library home page: https://github.com/google/gson
Path to dependency file: FastAsyncVoxelSniper/build.gradle.kts
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.code.gson/gson/2.8.0/c4ba5371a29ac9b2ad6129b1d39ea38750043eff/gson-2.8.0.jar
Dependency Hierarchy:
- Paster-1.1.1.jar (Root Library)
- ❌ gson-2.8.0.jar (Vulnerable Library)
Found in HEAD commit: 0649c58cb7de2f5347f14570533f13621fd97852
Found in base branch: main
Vulnerability Details
Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.
Publish Date: 2021-10-11
URL: WS-2021-0419
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/google/gson/releases/tag/gson-parent-2.8.9
Release Date: 2021-10-11
Fix Resolution: com.google.code.gson:gson:2.8.9
Step up your Open Source Security Game with WhiteSource here
