CVE-2017-1000397: Improper Input Validation

Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient...

PT-2018-5179

Name of the Vulnerable Software and Affected Versions Jenkins Maven Plugin versions 2.17 and earlier Description The issue concerns a vulnerability in the commons-httpclient library that incorrectly verifies SSL certificates, making it susceptible to man-in-the-middle attacks. Recommendations For...

UPDATE: OWASP Dependency-Check 3.0.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 3.0.0! This release comes with Java 9...

eu.seaclouds-project:seaclouds-qa (1.0.0), io.brooklyn.ambari:brooklyn-ambari (>=0.2.0, <=0.5.0-20160803.1156) +18 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-launcher (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-launcher MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory:...

com.a9ski.brooklyn:apache-brooklyn-ldap-provider (1.0.0), eu.seaclouds-project:seaclouds-qa (1.0.0) +24 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-rest-api (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-rest-api MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =0.7.0-incubating, =0.7.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory: SNYK:JAVA-ORGAPACHEBROOKLYN-9962107...

UPDATE: OWASP Dependency-Check 2.1.0!

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 2.1.0! What I like about this release...