[Snyk] Security upgrade com.google.http-client:google-http-client from 1.42.3 to 1.46.2#5850
[Snyk] Security upgrade com.google.http-client:google-http-client from 1.42.3 to 1.46.2#5850lgrill-pentaho wants to merge 1 commit into
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518 - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-5710356
|
Analysis Details0 Issues
Coverage and Duplications
Project ID: pentaho:pentaho-platform-ce-parent |
✅ Build finished in 11m 20sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl \
assemblies/pentaho-war❗ No tests found!ℹ️ This is an automatic message |
|
📦 Vulnerable Dependencies✍️ Summary
🔬 Research Details[ CVE-2021-3711 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2025-66516 ] org.apache.tika:tika-core 2.4.1Description: The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF). An XML External Entity (XXE) attack occurs when an XML parser, configured to process external entities, processes XML input containing references to external entities that an attacker controls. An attacker can craft a malicious XFA file (containing the XML) that exploits this to achieve an XXE attack, leading to a potential information disclosure and a denial of service (DoS), by embedding the malicious XML into a PDF file that will be processed by a server which uses Apache Tika. For example, if it parses an external XML file supplied by the attacker as follows: In this case, the attacker defines an external entity pointing to a local file on the server using the Similarly, the attacker can also achieve a Server-Side Request Forgery (SSRF) by using external entities pointing to internal server resources, and a denial of service (DoS) by leveraging the XML parser's need to expand nested entities recursively in order to exhaust the server's memory. The vulnerability is within the code that creates a new The fix replaced it with the Remediation: Development mitigationsBefore passing the candidate PDF file to Apache Tika (e.g., tika.parseToString), reject all files that contain the <!ENTITY substring - if (pdfRawStr.contains("<!ENTITY")) {
return ERROR_NO_DTD_ALLOWED;
}[ CVE-2025-55754 ] org.apache.tomcat:tomcat-catalina 9.0.106Description: The A potential attacker could exploit the vulnerability to trick a user reviewing the logs into running unsafe commands by disguising their malicious instructions as invisible or legitimate Tomcat logging messages. The user would still have to manually run a command in the prompt. The vulnerability has been proven to be exploitable when running Tomcat on the Windows operating system while reviewing Tomcat logs in a command prompt. Other operating systems have not been proven to be affected. The vulnerable formatters can be used in one of the following ways:
[ CVE-2016-1000027 ] org.springframework:spring-web 5.3.39Description: Remediation: Deployment mitigationsDo not use Java serialization for external endpoints (Do not extend the [ CVE-2018-3258 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2017-3523 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2025-48989 ] org.apache.tomcat:tomcat-coyote 9.0.106Description: This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue. [ CVE-2025-53506 ] org.apache.tomcat:tomcat-coyote 9.0.106Description: This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue. [ CVE-2025-52434 ] org.apache.tomcat:tomcat-util 9.0.106Description: This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue. [ CVE-2021-3712 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2021-3450 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2021-3449 ] mysql:mysql-connector-java 5.1.17Description: [ CVE-2022-41404 ] org.ini4j:ini4j 0.5.4Description: [ CVE-2026-0603 ] org.hibernate:hibernate-core 5.4.24.FinalDescription: [ CVE-2025-55752 ] org.apache.tomcat:tomcat-catalina 9.0.106Description: When the server receives a request by the user for a certain url, that request is passed to the rewrite rule. The rewritten url then should, in theory, be properly sanitized and checked - but the logical flaw in Tomcat caused these checks to be bypassed, allowing attackers to send a malicious url that isn't caught by Tomcat's sanitization. A server is vulnerable under the following conditions:
Or enabling it for a specific webapp in some
(in this case, the Under these conditions, arbitrary file read is possible. When PUT requests are enabled for the server, exploitation also leads to arbitrary file write, which immediately leads to remote code execution. In this case, an attacker could use the path traversal bug to insert a malicious To enable PUT requests for Tomca... Remediation: Development mitigationsDisable rewrite valve if it's not necessary, by removing the relevant: From Development mitigationsRemove vulnerable rewrite rules that make use of query parameters in the output. [ CVE-2025-41249 ] org.springframework:spring-core 5.3.39Description: The core of the vulnerability lies in how the Spring Framework's The most significant impact of this vulnerability is the potential for authorization bypass in applications that use Spring Security's For example, a developer might place a security annotation like Vulnerable code example: 1ue@qq.com>\r\nRCPT TO:phising-victim@qq.com\r\nDATA\r\nSubject:PWNED\r\n\r\nHack!\r\n.\r\nQUIT\r\n ServletFileUpload upload = new ServletFileUpload(factory); |
3 participants
Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.
Snyk changed the following file(s):
assemblies/pentaho-war/pom.xmlVulnerabilities that will be fixed with an upgrade:
SNYK-JAVA-COMMONSCODEC-561518
1.42.3->1.46.2No Known ExploitSNYK-JAVA-COMGOOGLEGUAVA-5710356
1.42.3->1.46.2No Known ExploitImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Creation of Temporary File in Directory with Insecure Permissions