Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Workflow failed: OWASP dependency check (daily) (#892) #4074

Open
github-actions bot opened this issue Feb 7, 2025 · 27 comments
Open

Workflow failed: OWASP dependency check (daily) (#892) #4074

github-actions bot opened this issue Feb 7, 2025 · 27 comments

Comments

@github-actions
Copy link
Contributor

github-actions bot commented Feb 7, 2025

See OWASP dependency check (daily) #892.
@MilovdZee
Copy link

Has to do with CVE-2024-57699. This is a high-risk issue and so a patch is needed quickly. Please fix this.

@jeanbisutti
Copy link
Member

@MilovdZee

json-smart is a transitive dependency: Application Insights -> Azure Identity -> msal4j -> json-smart

Our usage of the json-smart library doesn't accept any user input.

So, we don't think that the Application Insights Java agent can be impacted by this CVE.

We will update the more recent version in the next release.

@trask
Copy link
Member

trask commented Feb 7, 2025

related: AzureAD/microsoft-authentication-library-for-java#905

@github-actions GitHub Actions
Copy link
Contributor Author

github-actions bot commented Feb 8, 2025

See OWASP dependency check (daily) #893.

@github-actions GitHub Actions
Copy link
Contributor Author

github-actions bot commented Feb 9, 2025

See OWASP dependency check (daily) #894.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #895.

@MilovdZee
Copy link

MilovdZee commented Feb 10, 2025 •
edited
Loading

Thanks. Very annoying for us as I can't override our pipeline to accept this. So I can't deploy my service due to this. Even though there actually is no issue.
I'll investigate within the organization for a solution.
Thanks for the update anyway.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #896.

@gyula-kelemen
Copy link

gyula-kelemen commented Feb 11, 2025 •
edited
Loading

@jeanbisutti
Now the CVE-2025-24970 also appeared in our trivy scan. Are you affected by this?
Your OWASP scan has not reported it yet, but you are on an affected version: #4077

(update: fix wrong mention)

@MilovdZee
Copy link

@gyula-kelemen I don't know anything about that

@gyula-kelemen
Copy link

@gyula-kelemen I don't know anything about that

Ahh, sorry wrong tag.

@jeanbisutti jeanbisutti mentioned this issue Feb 11, 2025
Merged
@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #897.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #898.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #899.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #900.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #901.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #902.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #903.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #904.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #905.

@MilovdZee
Copy link

MilovdZee commented Feb 19, 2025 •
edited
Loading

There is a new version of json-smart. So it is very easy to fix. If not forced then I also see that Msal4j is updated. Probably for this but I did not check that. Also azure-identity seems to be updated.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #906.

@jeanbisutti
Copy link
Member

@jeanbisutti Now the CVE-2025-24970 also appeared in our trivy scan. Are you affected by this? Your OWASP scan has not reported it yet, but you are on an affected version: #4077

(update: fix wrong mention)

@gyula-kelemen #4077 will be included in our next release

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #907.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #908.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #909.

@github-actions GitHub Actions
Copy link
Contributor Author

See OWASP dependency check (daily) #910.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@trask @jeanbisutti @MilovdZee @gyula-kelemen