Expression Language Injection in Netflix Conductor

Netflix Conductor uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being...

com.netflix.conductor:conductor-contribs (0.0.4), com.netflix.conductor:conductor-jersey (0.0.4) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (0.0.4)

com.netflix.conductor:conductor-core MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 0.0.4 - com.netflix.conductor:conductor-jersey...

com.netflix.conductor:conductor-contribs (1.5.0), com.netflix.conductor:conductor-jersey (1.5.0) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.5.0)

com.netflix.conductor:conductor-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.5.0 - com.netflix.conductor:conductor-jersey...

com.netflix.conductor:conductor-contribs (1.5.1), com.netflix.conductor:conductor-jersey (1.5.1) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.5.1)

com.netflix.conductor:conductor-core MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.5.1 - com.netflix.conductor:conductor-jersey...

com.netflix.conductor:conductor-contribs (1.6.0-rc1), com.netflix.conductor:conductor-jersey (1.6.0-rc1) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.6.0-rc1)

com.netflix.conductor:conductor-core MAVEN version 1.6.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.6.0-rc1 -...

com.netflix.conductor:conductor-contribs (1.6.0), com.netflix.conductor:conductor-jersey (1.6.0) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.6.0)

com.netflix.conductor:conductor-core MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.6.0 - com.netflix.conductor:conductor-jersey...

com.netflix.conductor:conductor-contribs (1.6.1-rc1), com.netflix.conductor:conductor-jersey (1.6.1-rc1) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.6.1-rc1)

com.netflix.conductor:conductor-core MAVEN version 1.6.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.6.1-rc1 -...

com.netflix.conductor:conductor-contribs (1.6.1), com.netflix.conductor:conductor-jersey (1.6.1) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.6.1)

com.netflix.conductor:conductor-core MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.6.1 - com.netflix.conductor:conductor-jersey...

com.netflix.conductor:conductor-contribs (1.6.2-rc1), com.netflix.conductor:conductor-jersey (1.6.2-rc1) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.6.2-rc1)

com.netflix.conductor:conductor-core MAVEN version 1.6.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.6.2-rc1 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc2), com.netflix.conductor:conductor-jersey (1.7.0-rc2) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc2)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc2 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc3), com.netflix.conductor:conductor-jersey (1.7.0-rc3) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc3)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc3 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc4), com.netflix.conductor:conductor-jersey (1.7.0-rc4) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc4)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc4 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc5), com.netflix.conductor:conductor-jersey (1.7.0-rc5) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc5)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc5 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc6), com.netflix.conductor:conductor-jersey (1.7.0-rc6) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc6)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc6 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc6 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc9), com.netflix.conductor:conductor-jersey (1.7.0-rc9) +2 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc9)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc9 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc9 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc11), com.netflix.conductor:conductor-jersey (1.7.0-rc11) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc11)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc11 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc11 -...

com.netflix.conductor:conductor-contribs (1.7.0-rc12), com.netflix.conductor:conductor-jersey (1.7.0-rc12) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.0-rc12)

com.netflix.conductor:conductor-core MAVEN version 1.7.0-rc12 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.0-rc12 -...

com.netflix.conductor:conductor-contribs (1.7.2-rc1), com.netflix.conductor:conductor-jersey (1.7.2-rc1) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.2-rc1)

com.netflix.conductor:conductor-core MAVEN version 1.7.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.2-rc1 -...

com.netflix.conductor:conductor-contribs (1.7.2-rc3), com.netflix.conductor:conductor-jersey (1.7.2-rc3) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.2-rc3)

com.netflix.conductor:conductor-core MAVEN version 1.7.2-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.2-rc3 -...

com.netflix.conductor:conductor-contribs (1.7.2-rc4), com.netflix.conductor:conductor-jersey (1.7.2-rc4) +1 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (1.7.2-rc4)

com.netflix.conductor:conductor-core MAVEN version 1.7.2-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on com.netflix.conductor:conductor-core and may be impacted: - com.netflix.conductor:conductor-contribs 1.7.2-rc4 -...