vulnerablecode/vulnerabilities/tests/test_data/osv_test/github/github-3.json at 8ec85fab50fea8e3525337e07c1a03c48a712849 · ziadhany/vulnerablecode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
{
  "schema_version": "1.4.0",
  "id": "GHSA-8hxh-r6f7-jf45",
  "modified": "2021-10-04T21:26:20Z",
  "published": "2020-10-16T17:03:43Z",
  "aliases": [],
  "summary": "Memory exhaustion in http4s-async-http-client with large or malicious compressed responses",
  "details": "### Impact\nA server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM.  It does not affect http4s servers, other client backends, or clients that speak only to trusted servers.  This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by [CVE-2020-11612](https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897).\n\n### Patches\nUpgrade to http4s-async-http-client >= 0.21.8.  All 1.0 milestones are also safe.\n\n### Workarounds\nAdd an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:\n\n```scala\nlibraryDependencies ++= Seq(\n  \"io.netty\" %  \"netty-codec\"         % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-codec-socks\"   % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-handler-proxy\" % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-common\"        % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-transport\"     % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-handler\"       % \"4.1.53.Final\" % Runtime,\n  \"io.netty\" %  \"netty-resolver-dns\"  % \"4.1.53.Final\" % Runtime\n)\n```\n\n### References\n* https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897\n* https://github.com/http4s/http4s/issues/3681\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [http4s](https://github.com/http4s/http4s/issues/new)\n* Contact a maintainer privately per [http4s' security policy](https://github.com/http4s/http4s/blob/master/SECURITY.md#reporting-a-vulnerability)",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-async-http-client_2.13"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.8"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 0.21.7"
      }
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-async-http-client_2.12"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.8"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 0.21.7"
      }
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-8hxh-r6f7-jf45"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/http4s/http4s"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-16T17:03:18Z",
    "nvd_published_at": null
  }
}