io.dropwizard.archetypes:java-simple (0.9.0-rc2), io.dropwizard:dropwizard-assets (0.9.0-rc2) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc2 - io.dropwizard:dropwizard-assets...

io.dropwizard.archetypes:java-simple (0.9.0-rc3), io.dropwizard:dropwizard-assets (0.9.0-rc3) +24 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc3 - io.dropwizard:dropwizard-assets...

fr.mmarie:gitlab-jira-integration-api (>=0.2.0, <=0.5.0-rc1), fr.mmarie:gitlab-jira-integration-application (0.2.0) +23 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc4)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - fr.mmarie:gitlab-jira-integration-api =0.2.0, =0.5.0-rc1 -...

be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-12, <=0.1-16), be.fluid-it.microservice.bundle:microservice-bundle-showcase (>=0.1-12, <=0.1-16) +60 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.3)

io.dropwizard:dropwizard-validation MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.microservice.bundle:microservice-bundle-core =0.1-12, =0.1-12, =0.1-12,...

com.hubspot.dropwizard:dropwizard-guice (0.8.0), io.dropwizard.archetypes:java-simple (0.8.0-rc3) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.hubspot.dropwizard:dropwizard-guice 0.8.0 - io.dropwizard.archetypes:java-simple...

io.dropwizard.archetypes:java-simple (0.8.0-rc4), io.dropwizard:dropwizard-assets (0.8.0-rc4) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc4)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc4 - io.dropwizard:dropwizard-assets...

io.dropwizard.archetypes:java-simple (0.8.1-rc2), io.dropwizard:dropwizard-assets (0.8.1-rc2) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.1-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.1-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.1-rc2 - io.dropwizard:dropwizard-assets...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...

com.bendb.dropwizard:dropwizard-jooq (2.0.2-0), com.bendb.dropwizard:dropwizard-redis (2.0.2-0) +79 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.2)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =0.99.0, =0.311.6, =0.311.6, =0.312.2-rc2, =0.711.0 and more Source cves: CVE-2020-11002 Source advisory: GHSA-8JPX-M2WH-2V34...

io.dropwizard.archetypes:java-simple (0.8.0-rc2), io.dropwizard:dropwizard-assets (0.8.0-rc2) +30 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc2 - io.dropwizard:dropwizard-assets...

io.dropwizard.archetypes:java-simple (0.8.0-rc5), io.dropwizard:dropwizard-assets (0.8.0-rc5) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc5)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc5 - io.dropwizard:dropwizard-assets...

io.dropwizard:dropwizard-assets (0.7.0-rc3), io.dropwizard:dropwizard-auth (0.7.0-rc3) +18 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard:dropwizard-assets 0.7.0-rc3 - io.dropwizard:dropwizard-auth 0.7.0-rc3 -...

be.fluid-it.tools.dropwizard:wizard-in-a-box (>=0.8-1-1, <=0.8-1-2), com.bazaarvoice.curator:dropwizard (1.4.2) +81 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.tools.dropwizard:wizard-in-a-box =0.8-1-1, =0.7.0, =0.7.0, =0.7.0, =0.7.2 -...

co.paralleluniverse:comsat-dropwizard (0.5.0), com.hubspot.dropwizard:dropwizard-guice (0.8.3.0) +26 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.3)

io.dropwizard:dropwizard-validation MAVEN version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - co.paralleluniverse:comsat-dropwizard 0.5.0 - com.hubspot.dropwizard:dropwizard-guice...

com.datasift.dropwizard.scala:dropwizard-scala-core_2.10 (>=0.8.5-1, <=0.8.5-2), com.datasift.dropwizard.scala:dropwizard-scala-core_2.11 (>=0.8.5-1, <=0.8.5-2) +45 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.5)

io.dropwizard:dropwizard-validation MAVEN version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.datasift.dropwizard.scala:dropwizard-scala-core2.10 =0.8.5-1, =0.8.5-1, =0.8.5-1,...

be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-6, <=0.1-10), be.fluid-it.microservice.bundle:microservice-bundle-showcase (>=0.1-6, <=0.1-10) +93 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.1)

io.dropwizard:dropwizard-validation MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.microservice.bundle:microservice-bundle-core =0.1-6, =0.1-6, =0.1-9, =0.1-6,...

CVE-2020-11002

CVE-2020-11002 affects Dropwizard-validation prior to 1.3.21 and 2.0.3, where a server-side template injection in the self-validating feature enables injection of arbitrary Java EL expressions, leading to Remote Code Execution (RCE). Affected: dropwizard-validation versions before 1.3.21 and 2.0....

CVE-2020-11002

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

com.bendb.dropwizard:dropwizard-jooq (2.0.2-0), com.bendb.dropwizard:dropwizard-redis (2.0.2-0) +79 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.2)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =0.99.0, =0.311.6, =0.311.6, =0.312.2-rc2, =0.711.0 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: MEND:CVE-2020-11002...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-1, <=0.1-16) +741 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=0.7.0-rc1, <=1.3.20)

io.dropwizard:dropwizard-validation MAVEN version =0.7.0-rc1, =0.1-1, =0.1-1, =0.1-9, =0.1-5, =0.8-1-1, =0.0.105, =0.7.0.3, =1.0, =0.1.0, =0.2.0, =0.7.0 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: MEND:CVE-2020-11002...