11 matches found
com.sngular:scc-multiapi-converter (3.4.0), gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=3.1.0, <=3.1.9) +17 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=3.1.0, <=3.1.9)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =3.1.0, =3.1.0, =0.32.0.release, =2.3.0, =4.4.6, =4.4.6, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.9 - org.springframework.cloud:spring-cloud-contract-stub-runn...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=4.0.1, <=4.0.4), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (>=4.0.0, <=4.0.4) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=4.0.0, <=4.0.4)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =4.0.0, =4.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.4 Source cves: CVE-2024-22236 Source advisory: OSV:GHSA-P6RP-MX85-M459...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=4.0.1, <=4.0.4), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (>=4.0.0, <=4.0.4) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=4.0.0, <=4.0.4)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =4.0.0, =4.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.4 Source cves: CVE-2024-22236 Source advisory: GHSA-P6RP-MX85-M459...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (4.1.0), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (4.1.0) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (4.1.0)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-contract-shade and may be impacted: -...
com.sngular:scc-multiapi-converter (3.4.0), gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=3.1.0, <=3.1.9) +17 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=3.1.0, <=3.1.9)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =3.1.0, =3.1.0, =0.32.0.release, =2.3.0, =4.4.6, =4.4.6, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.9 - org.springframework.cloud:spring-cloud-contract-stub-runn...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (4.1.0), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (4.1.0) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (4.1.0)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-contract-shade and may be impacted: -...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (4.1.0), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (4.1.0) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (4.1.0)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-contract-shade and may be impacted: -...
CVE-2024-22236
In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in...
com.sngular:scc-multiapi-converter (3.4.0), gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=3.1.0, <=3.1.9) +17 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=3.1.0, <=3.1.9)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =3.1.0, =3.1.0, =0.32.0.release, =2.3.0, =4.4.6, =4.4.6, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.9 - org.springframework.cloud:spring-cloud-contract-stub-runn...
gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=4.0.1, <=4.0.4), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (>=4.0.0, <=4.0.4) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=4.0.0, <=4.0.4)
org.springframework.cloud:spring-cloud-contract-shade MAVEN version =4.0.0, =4.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.4 Source cves: CVE-2024-22236 Source advisory: MEND:CVE-2024-22236...
CVE-2024-22236: Incorrect Permission Assignment for Critical Resource
In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in...