Skip to content

[Snyk] Security upgrade org.apache.tomcat:tomcat-catalina from 7.0.27 to 7.0.104 - #6

Open
karencapiiro wants to merge 1 commit into
masterfrom
snyk-fix-e3dd72bda30ebc1fb7ea588dd12f441f
Open

[Snyk] Security upgrade org.apache.tomcat:tomcat-catalina from 7.0.27 to 7.0.104#6
karencapiiro wants to merge 1 commit into
masterfrom
snyk-fix-e3dd72bda30ebc1fb7ea588dd12f441f

Conversation

@karencapiiro

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 4 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • webgoat/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
high severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHETOMCAT-451516
  893   org.apache.tomcat:tomcat-catalina:
7.0.27 -> 7.0.104
Mature
high severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHETOMCAT-460343
  893   org.apache.tomcat:tomcat-catalina:
7.0.27 -> 7.0.104
Mature
high severity Remote Code Execution
SNYK-JAVA-ORGAPACHETOMCAT-174342
  764   org.apache.tomcat:tomcat-catalina:
7.0.27 -> 7.0.104
Mature
high severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHETOMCAT-570036
  746   org.apache.tomcat:tomcat-catalina:
7.0.27 -> 7.0.104
Mature

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Execution

@socket-security

Copy link
Copy Markdown

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
maven/org.apache.tomcat/tomcat-catalina@7.0.104 environment, eval, filesystem, network, shell, unsafe +5 4.85 MB

🚮 Removed packages: maven/org.apache.tomcat/tomcat-catalina@7.0.27

View full report↗︎

@rafikmojr

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Detailscea76924-4c2d-40ce-ae9f-fc8b535a7e6f

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2022-23181 Maven-org.apache.tomcat:tomcat-catalina-7.0.104 Vulnerable Package
HIGH CVE-2023-26464 Maven-log4j:log4j-1.2.8 Vulnerable Package
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 133 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/instructor/CrossSiteScripting/FindProfile_i.java: 51 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java: 132 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/WsSqlInjection.java: 161 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java: 60 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java: 192 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 178 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlModifyData.java: 166 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlAddData.java: 148 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 98 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/ThreadSafetyProblem.java: 80 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/BlindNumericSqlInjection.java: 80 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Parameter_Tampering /webgoat/src/main/java/org/owasp/webgoat/lessons/BlindStringSqlInjection.java: 80 Attack Vector
MEDIUM Relative_Path_Traversal /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816 Attack Vector
MEDIUM Relative_Path_Traversal /webgoat/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java: 79 Attack Vector

Fixed Issues

Severity Issue Source File / Package
HIGH CVE-2015-5346 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2016-0714 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2016-5388 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2016-6797 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2017-12615 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2017-12616 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2017-12617 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2017-5648 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2017-5664 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2018-1336 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2019-0232 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2019-17563 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH CVE-2020-9484 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
HIGH Command_Injection /webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 641
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
MEDIUM CSRF /webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
MEDIUM CVE-2012-3546 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2012-4431 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2012-5885 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2012-5886 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2012-5887 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2013-1976 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2013-2067 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2013-4590 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2014-0096 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2014-0119 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2015-5345 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2016-0706 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2016-0762 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2016-0763 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2016-6794 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2017-7674 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2018-11784 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2018-1304 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM CVE-2018-1305 Maven-org.apache.tomcat:tomcat-catalina-7.0.27
MEDIUM Cleartext_Submission_of_Sensitive_Information /webgoat/src/main/webapp/lessons/SQLInjection/ViewProfile.jsp: 67
MEDIUM Cleartext_Submission_of_Sensitive_Information /webgoat/src/main/webapp/lessons/SQLInjection/EditProfile.jsp: 67
MEDIUM Cleartext_Submission_of_Sensitive_Information /webgoat/src/main/webapp/lessons/RoleBasedAccessControl/ViewProfile.jsp: 67
MEDIUM Cleartext_Submission_of_Sensitive_Information /webgoat/src/main/webapp/lessons/RoleBasedAccessControl/EditProfile.jsp: 66
MEDIUM Cleartext_Submission_of_Sensitive_Information

More results are available on AST platform

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants