GHSA-8JPX-M2WH-2V34 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...

io.dropwizard:dropwizard-assets (0.7.0-rc3), io.dropwizard:dropwizard-auth (0.7.0-rc3) +18 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard:dropwizard-assets 0.7.0-rc3 - io.dropwizard:dropwizard-auth 0.7.0-rc3 -...

com.massrelevance:dropwizard-scala_2.10 (0.7.0-rc1), io.dropwizard:dropwizard-assets (0.7.0-rc1) +19 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.massrelevance:dropwizard-scala2.10 0.7.0-rc1 - io.dropwizard:dropwizard-assets...

com.hubspot.dropwizard:dropwizard-guice (0.8.0), io.dropwizard.archetypes:java-simple (0.8.0-rc3) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.hubspot.dropwizard:dropwizard-guice 0.8.0 - io.dropwizard.archetypes:java-simple...

io.dropwizard.archetypes:java-simple (0.8.0-rc2), io.dropwizard:dropwizard-assets (0.8.0-rc2) +30 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc2 - io.dropwizard:dropwizard-assets...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...

be.fluid-it.tools.dropwizard:wizard-in-a-box (>=0.8-2-1, <=0.8-2-2), com.disdar:disdar-api-client-java (0.3.0) +38 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.tools.dropwizard:wizard-in-a-box =0.8-2-1, =1.0.0, =0.1.12, =0.5.25 -...

com.brightcove:dropwizard-s3-config (1.0.0), com.github.autoscaler:autoscale-core (>=1.0.0-12, <=1.2.0-79) +67 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.4)

io.dropwizard:dropwizard-validation MAVEN version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.brightcove:dropwizard-s3-config 1.0.0 - com.github.autoscaler:autoscale-core =1.0.0-1...

io.dropwizard.archetypes:java-simple (0.8.0-rc5), io.dropwizard:dropwizard-assets (0.8.0-rc5) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc5)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc5 - io.dropwizard:dropwizard-assets...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), be.tomcools:dropwizard-websocket-jee7-bundle (>=2.0.0-snapshot, <=2.0.0) +437 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (>=1.0.0-rc1, <=1.3.20)

io.dropwizard:dropwizard-validation MAVEN version =1.0.0-rc1, =2.0.0-snapshot, =1.0, =1.0.1, =2.9.0, =3.6.0, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0-0, =1.3.5-1 and more Source cves: CVE-2020-11002 Source advisory: OSV:GHSA-8JPX-M2WH-2V34...

com.bendb.dropwizard:dropwizard-jooq (2.0.2-0), com.bendb.dropwizard:dropwizard-redis (2.0.2-0) +79 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.2)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =0.99.0, =0.311.6, =0.311.6, =0.312.2-rc2, =0.711.0 and more Source cves: CVE-2020-11002 Source advisory: OSV:GHSA-8JPX-M2WH-2V34...

io.dropwizard.archetypes:java-simple (0.8.1-rc2), io.dropwizard:dropwizard-assets (0.8.1-rc2) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.1-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.1-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.1-rc2 - io.dropwizard:dropwizard-assets...

be.fluid-it.tools.dropwizard:wizard-in-a-box (>=0.8-1-1, <=0.8-1-2), com.bazaarvoice.curator:dropwizard (1.4.2) +81 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.tools.dropwizard:wizard-in-a-box =0.8-1-1, =0.7.0, =0.7.0, =0.7.0, =0.7.2 -...

io.dropwizard.archetypes:java-simple (0.8.0-rc4), io.dropwizard:dropwizard-assets (0.8.0-rc4) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc4)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc4 - io.dropwizard:dropwizard-assets...

com.datasift.dropwizard.scala:dropwizard-scala-core_2.10 (>=0.8.5-1, <=0.8.5-2), com.datasift.dropwizard.scala:dropwizard-scala-core_2.11 (>=0.8.5-1, <=0.8.5-2) +45 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.5)

io.dropwizard:dropwizard-validation MAVEN version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.datasift.dropwizard.scala:dropwizard-scala-core2.10 =0.8.5-1, =0.8.5-1, =0.8.5-1,...

be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-6, <=0.1-10), be.fluid-it.microservice.bundle:microservice-bundle-showcase (>=0.1-6, <=0.1-10) +93 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.1)

io.dropwizard:dropwizard-validation MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.microservice.bundle:microservice-bundle-core =0.1-6, =0.1-6, =0.1-9, =0.1-6,...

be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-12, <=0.1-16), be.fluid-it.microservice.bundle:microservice-bundle-showcase (>=0.1-12, <=0.1-16) +60 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.3)

io.dropwizard:dropwizard-validation MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.microservice.bundle:microservice-bundle-core =0.1-12, =0.1-12, =0.1-12,...

com.bazaarvoice.curator:dropwizard (>=1.4.3, <=1.5.2), com.github.justcoke:dropwizard-jackrabbit (0.2.3) +45 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.bazaarvoice.curator:dropwizard =1.4.3, =0.9.1-0, =0.9.1-1 -...

io.dropwizard.archetypes:java-simple (0.9.0-rc1), io.dropwizard:dropwizard-assets (0.9.0-rc1) +23 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc1 - io.dropwizard:dropwizard-assets...

io.dropwizard.archetypes:java-simple (0.9.0-rc2), io.dropwizard:dropwizard-assets (0.9.0-rc2) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc2 - io.dropwizard:dropwizard-assets...